* Operator managed trusted_cluster guide
* Fix lint
* Fix lint
* Fix lint
- Add How it works section
- Capitalize Teleport Agent
* Fix list indentation
* Link Linux demo guide
* Replace invitation token -> join token
* Consolidate tctl, operator, and terraform guide
* Use double quotes in tf file
The latest version of terraform does not support single quotes
* version field is required
* Fix links
* Pull condition operators into a one of
* Add wrapper structs to support repeated
* Adjust for new protos
* Fix tflint
* Start fixing tests
* Add more test cases
* More test cases
* Fix marshalling of resource
* Fix test in lib/services
Closes#48745
Add a warning to the External Audit Storage page that this feature is
not compatible with Access Monitoring on Teleport Enterprise (Cloud),
complementing the warning on the Access Monitoring page.
* Remove v13 mentions in the docs
Our policy is to remove mentions of the version prior to the most recent
deprecated version.
This change includes mentions of v13 in Helm chart values file comments.
* Clarify distroless images in Helm values
Responds to hugoShaka feedback.
The dots cause issues with our hosting infrastructure, which returns
404s when users make requests for Kubernetes operator reference pages
with no trailing slash.
This change returns a filename from the format function in the CRD/CRD
docs generator so we can return different file names for CRDs and their
docs. It also renames CRD docs pages to include hyphens instead of dots
and underscores, and adds redirects.
* fix: access graph fails to fetch s3 bucket details
With SDK V1, AWS get bucket details such as policies, acls, status...
didn't require the specification of the target s3 bucket location. With
the recent changes to support newer versions of the AWS SDK, the get
bucket details started to fail with the following error:
```
BucketRegionError: incorrect region, the bucket is not in 'ap-south-1' region at endpoint '', bucket is in 'eu-central-1' region
status code: 301, request id: QS5C24H12ZV3VNM4, host id: mzVDk4010MPTCFdxyE/XwERX9W35MSge85PG+h5Jvwyvi7MhxdXLaysb2PTZCMY9r1ngBi6Gv6g=, failed to fetch bucket "cyz" acls polic
```
This PR uses `HeadBucket` to retrieve the location of the s3 bucket and
then uses the bucket location client to retrieve the s3 bucket details.
Fixes#50757
* fix tests
* handle review comments
* Extend the protobuf
* Wire up DNS SAN field to issuance code
* Regenerate tfschema
* Add DNS SANs to the audit event
* Add test
* Rename to x509
* Add test/check that validates hostname generated
* Fix TS proto
* Update lib/auth/machineid/workloadidentityv1/decision_test.go
Co-authored-by: Tim Buckley <tim@goteleport.com>
---------
Co-authored-by: Tim Buckley <tim@goteleport.com>
Closes#23277
Document the `types`, `skip-event-types`, and `skip-session-types` event
handler configuration fields. The `finish-event-handler-config.mdx`
partial is the most appropriate place for this, since it already
includes instructions for tailoring the user's event handler
configuration.
Changing the hostname of a node resource will update in the web UI
very quickly, but attempting to connect to the resource using it's
new hostname will fail if the new hostname is not present in the
node's host certificate.
Closes#42315
- Getting started guide for auto-discovering Kubernetes applications.
- DynamoDB (as an application) guide. This change does not address one
Vale warning with `tsh aws dymamodb`, which is a false positive.
- Getting started guide for protecting applications.
* Edit docs CI workflows to accommodate Docusaurus
- Copy the `gravitational/teleport` source into the `content` directory
of a `gravitational/docs-website` clone and overwrite the `git-update`
yarn script with a no-op command. With way, we can use the
`gravitational/teleport` clone across multiple workflow steps (e.g.,
the prose linting step), and can identify a branch to pull using the
`actions/checkout` defaults. Name the submodule directory `current` to
match the expectations of the Docusaurus site.
- Remove the Vercel preview workflow. After the docs engine migration,
we'll no longer need to deploy a preview to Vercel in order to show
docs authors what their potential changes look like on a rendered docs
site.
Also fixes spelling errors caught by a later version of cspell.
* Fix shellcheck issues in doc-tests.yaml script
- Add `exit` commands for failed `cd`s
- Don't read from and write to `package.json` in the same pipeline
- Add double quotes around variables
* Use latest Docusaurus site config schema
* Fix the Prepare docs site configuration step
- Remove unneeded `cd`s
- Use the correct version name in the `config.json` prepared for the
Docusaurus site
* First pass at trying to generate terraform provider
* Wire up types
* Fix generation of docs
* Add godoc comments
* Add tests
* Tflint and add example
Closes#47068
The TTL shown in a `tctl auth sign` command does not correspond to the
description of the TTL. Fix the description while making the TTL an
integer divisible by 24.
* Detail DAC and TAG integration from the user perspective
* Change wording to make linter happy.
* Fix broken links and spacing
* Update docs/pages/admin-guides/teleport-policy/database-access-controls.mdx
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update screenshots. Drop redundant instructions and merge the information into an existing suitable page.
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Add WorkloadIdentityLabels field to role
* Wire up access checker
* Add validation for new field
* Update CRDs
* Add to terraform provider
* Mispel some words to keep the republic happy
* Add WorkloadIdentityLabelsExpression
* Update Terraform provider
* Add to operator CRD
* PLS RUN CLA CHECK
One edge case is the `structure.architecture-h2` warning in
`docs/pages/includes/database-access/rds-proxy.mdx`. This is technically
correct, since the "How it works" section is before the "Prerequisites"
section. We can determine whether this is a bug to fix in a separate
change.
The Teleport package that is installed for RDP access as local
Windows users is not signed by Microsoft and therefore will not
load on systems with LSA protection enabled.
Updates gravitational/teleport.e#5615
* Suggest enabling PROXY protocol in DTW troubleshooting
* Mention audit as a source of information for errors
* Mention solutions for both L7 and L4 LBs
* Link X-Forwarded-For to config references
Bartosz Leper