* Document the Systemd workload attestor
* Document the `binary_path` and `binary_hash` attribute
* Replace period with colon
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Add "dbus" to the linter's known words
* Better grammar
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove extraneous newlines in list
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* minimal draft
* Add note on enabling TLS for Oracle RDS
* Full Oracle RDS guide
* update SQL Server adutil installation instructions
* Update Oracle RDS database documentation to include audit logging steps. Small corrections to self-hosted guide.
* Fix typos
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove tabs
* Address part of review comments
* add small comments
* Apply suggestions from code review
Co-authored-by: Gabriel Corado <gabriel.oliveira@goteleport.com>
* expand troubleshooting, tls setup
* note on SQLcl and alternatives
* misaligned columns aligned shall be now
* Typos/spelling
* drop empty line
* Optimize PNG
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Gabriel Corado <gabriel.oliveira@goteleport.com>
* Document the Podman and Docker workload attestors
* Use more direct language and fix typo
* Add "rootlessly" and "rootfully" to recognized words
* Use proper `code` blocks and improved grammar
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use real tbot image name
* Linter doesn't like angle brackets
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add CLI reference
* Start fleshing out pages for new docs
* Link out to Terraform provider information
* Start putting together workload-identiyt-api svc reference
* Minor adjustments
* Keep hacking on reference for resource
* Keep hacking on reference
* Add to list of templating supported fields
* Add TOC
* Add rules to the example yaml
* Flesh out workload-identity-api docs page
* Add some todos
* Add skeleton of attributes page
* ADd comments
* Cross page links
* Retitle page
* Link one reference to another
* Add template for selector
* SPAG
* Fix link
* Fix TODO link
* ADd tbot start workload-identity-jwt to cli reference
* Add `workload-identity-x509` to config reference
* Start documenting join attributes
* Finish last batch of join attrs
* Add some short exsplanations/summaries
* Start explaining rules
* Shorter explanation
* Add opener to Workload Identity API and Workload Attestationreference
* SPAG
* Add docs for selector
* Fill out migration guide
* rename/reorg
* Add short note on SPIFFE Workload API
* SPAG
* Fix links
* Operator managed trusted_cluster guide
* Fix lint
* Fix lint
* Fix lint
- Add How it works section
- Capitalize Teleport Agent
* Fix list indentation
* Link Linux demo guide
* Replace invitation token -> join token
* Consolidate tctl, operator, and terraform guide
* Use double quotes in tf file
The latest version of terraform does not support single quotes
* version field is required
* Fix links
* Edit docs CI workflows to accommodate Docusaurus
- Copy the `gravitational/teleport` source into the `content` directory
of a `gravitational/docs-website` clone and overwrite the `git-update`
yarn script with a no-op command. With way, we can use the
`gravitational/teleport` clone across multiple workflow steps (e.g.,
the prose linting step), and can identify a branch to pull using the
`actions/checkout` defaults. Name the submodule directory `current` to
match the expectations of the Docusaurus site.
- Remove the Vercel preview workflow. After the docs engine migration,
we'll no longer need to deploy a preview to Vercel in order to show
docs authors what their potential changes look like on a rendered docs
site.
Also fixes spelling errors caught by a later version of cspell.
* Fix shellcheck issues in doc-tests.yaml script
- Add `exit` commands for failed `cd`s
- Don't read from and write to `package.json` in the same pipeline
- Add double quotes around variables
* Use latest Docusaurus site config schema
* Fix the Prepare docs site configuration step
- Remove unneeded `cd`s
- Use the correct version name in the `config.json` prepared for the
Docusaurus site
Closes#21264
Edit the section on downloading TAR archives, since this already
includes information on installing Teleport from a local, downloaded
file.
* Improve access graph documentation
This PR introduces a recommendation for users to enable Okta/Entra synchronization to improve the user experience when working with Crown Jewels. Ephemeral, highly privileged users created by the SSO connector can generate excessive activity, rendering Crown Jewels difficult to use.
Additionally, the PR includes examples of the new `ssh_keys` view when utilizing the Policy SSH Keys scan functionality.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle review comments
* handle review comments
* fix doc linter
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Framework out Azure Workload Identity Federation documentation
* Add prereq/intro
* Add section on deciding a SPIFFE ID structure
* Add outline headings
* Add initial steps
* Add instructions for using CLI and SDK
* Finish up Azure workload id guide
* Minor fixup
* [entraid] Add docs to setup integration for air gapped clusters
This PR adds docs for Teleport Entra Id integration for air gapped clusters where internet access to their proxies isn't available.
This guide also adds a manual step for users that do not want Teleport to automatically setup Azure Entra ID Applications.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* fix spell issues
* Update docs/pages/admin-guides/teleport-policy/integrations/entra-id.mdx
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* handle code review comments
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* handle code review comments
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update host-user-creation.mdx
The necessary line for our Centos builds:
#includedir /etc/sudoers.d
# is not a comment, even though it usually means a comment in sudoers.
Current Debian uses @includedir.
* Update host-user-creation.mdx
* Update host-user-creation.mdx
Updated the doc
* Update host-user-creation.mdx
Updated the doc
* Update host-user-creation.mdx
Updated per your suggestion
* Update docs/pages/enroll-resources/server-access/guides/host-user-creation.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/enroll-resources/server-access/guides/host-user-creation.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Fix spelling
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Allow operator secret lookup
* Document which fields can lookup secrets
* operator: support secret lookup
* fixup! operator: support secret lookup
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* lint
* add link to operator docs
* address feedback
* Revert "add link to operator docs"
This reverts commit cd812eb453.
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Start roughly hacking on a chart for tobt
* Start templating out the deployment spec
* Add image pull secrets
* Add more configurability to deployment spec
* Pull most config into params rather than config map
* Prefer configuring using config file
* Add to index
* Allow configuration of extraEnv
* Fix extraEnv
* Update makefile to test/lint new tbot chart
* Start adding tests for `tbot` chart
* Fix spurious newline in config mpa
* Add more tests for volumes/tolerations etc
* Appease vale linting
* Add docstrings to all values
* Add required values
* Make services/outputs manually configurable
* Use simpler storage technique
* Generate docs
* Fix linting issues
* Simple -> Basic
* Add support for fullnameoverride and nameoverride
* Add extended timeout seconds to liveness and readiness probe
* Add _config.tpl with merging
* Tweak readme for latest changes
* Allow persistence to be configured and use `secret` by default
* Further add validation
* Update snapshtos
* Fix newlining in templates
* Fixes after real testing against cluster
* More value docs + derive the default output name
* fixup! More value docs + derive the default output name
* Update cpsell
* Update Chart.yaml
* Appease prose linter
* Remove unused value
---------
Co-authored-by: hugoShaka <hugo.hervieux@goteleport.com>
* Document how to use the TF provider
* fix config.json
* fixup! fix config.json
* Address first feedback wave
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* fix lint docs
* re-render TF docs
* workaround the broken vars in hcl code blocks
* Edits after testing the GCP docs
* Edits after testing the AWS docs
* Edits after testing the GHA docs
* Edits after testing the GitLab docs
* Edits after testing the CircleCI docs
* lint
* lint pt .2
* fix link after rebase + move resource import
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Teleport Operator reference docs contain a large number of internal link
references that fail the spell checker. Until we find a more scalable
spell check workflow (#46191), ignore these reference docs in the spell
checker.
* Add a two-part Terraform starter guide
Closes#41055
Add a learning series for users who wants to get started with managing
Teleport resources using Terraform. The guide takes the user through
some fundamental cluster setup tasks: deploying Agents, enrolling
resources, adding labels, configuring roles, and setting up SSO. The
series includes two guides:
- Part One: Enrolling resources
- Part Two: Configuring RBAC
Part One of the series is based on the "Deploy Agents with Terraform"
guide. This change adds instructions to the guide to label
infrastructure resources so the user can access those resources with the
roles configured in Part Two.
Other changes:
- Rename `agent-pool-terraform` to `terraform-starter`.
- Rename the "Dynamic Resources" guide to be more explicitly about
Infrastructure as Code. Organize this section into subsections to make
room for the new starter guide.
- Edit the Further Reading discussion in Part One. Move the static
resource discussion to Further Reading because, otherwise, there is
too much explanatory text between instructions. Also mention
auto-discovery.
* Respond partially to hugoShaka feedback
- Fix link syntax.
- Set expectations that the child modules downloaded in the two guides
are examples.
- Remove diagram with outdated logo.
- Use purpose-oriented names for TF files instead of `main.tf`
- Use `tctl terraform env` to get credentials
* Only deploy SSH Service in enroll-resources.mdx
Responds to hugoShaka feedback.
Resources that are not SSH servers registered via the SSH Service have
some complexities that don't make sense to cover in this guide. Instead,
for simplicity, the guide has the user deploy SSH Service instances,
then includes the possibility of enrolling other kinds of resources in a
"Next steps" section.
Changes:
- Remove the `agent_roles` input in the
`terraform-starter/agent-installation` module.
- Only deploy a token for the Node role, and configure the Agents
deployed by the module to only enable the SSH Service.
- Add an agent_labels input to the `agent-installation` module.
- Move non-server deployment instructions to "Next steps".
* Respond to thedevelopnik feedback
Note that you can skip the SSO step in the RBAC guide. Include links to
relevant docs.
* Respond to bernardjkim feedback
* A handful of smaller fixes.
* Oracle Exadata guide.
* Apply suggestions from code review
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Reorganise, update doc.
* Update docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/oracle-exadata.mdx
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Update docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/oracle-exadata.mdx
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* A few minor corrections and clarifications.
* Move to 'managed databases' from 'self-hosted'.
* Update index page.
* include intro for non-self-hosted dbs
* extend cspell.json with extra random words
* Fix lint warnings which are treated as errors.
---------
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Machine ID: Terraform Cloud joining
This adds a new `terraform` join method, which uses Terraform Cloud's
Workload Identity OIDC provider to provide delegated joining support
for Machine ID bots. As the Terraform provider now embeds tbot, this
means - with some light modifications - that the Terraform provider
can now join using this join method, and without any secrets.
* Address some review feedback, add first batch of tests
This addresses a few feedback items, defaulting the audience to the
Teleport cluster name and requiring allow rules specify an
organization + at least one other parameter.
Also, adds a first batch of tests.
* Update autogenerated CRD docs
* Add tests for RegisterUsingToken and provisioning token init
* Fix imports
* Fix CRD docs
* Update tfschema
* Update tf docs
* Update docstring to make it clear that `Audience` is optional
* Update manifests
* Update CRD docs
* Code review feedback; docstring fixes
* Rename lib/terraform to lib/terraformcloud
* Rename terraform -> terraform_cloud
Renames the new join method to terraform_cloud to make it clear that
it won't work for TF running elsewhere (where other join methods
should be used)
* Fix tests and docs lints
* Update api/proto/teleport/legacy/types/types.proto
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Update proto artifacts
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Machine ID: Documentation for Bot Instances
This adds some basic documentation discussing what Bot Instances are
and how to inspect them.
* Fix docs lints
* Update cspell.json
* Fix docs lints; undo editor-induced whitespace changes in json
* Remove old references to "bot instances"
* Add KWA features into the machine id config reference
* Add example manifests for tbot service for workload attestation
* Update docs/pages/enroll-resources/machine-id/workload-identity/workload-attestation.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add more detail to explanation of workload attestation
* Add table
* Update cspell
* Fix spelling of connect
* Fix spelling of attested
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Auto-generate operator CRD docs
We already pull JSON schema data from Teleport protobuf message
definitions in order to generate CRD manifests. Extract a shared library
from code within the existing protoc plugin for generating CRDs. This
way, we can use the library to generate docs for our CRDs with a
separate plugin, and don't need to complicate the interface for using
the existing plugin.
- Organize `integrations/crdgen` into `lib` and `cmd` directories,
turning `lib` into a package.
- Edit the `generateSchema` signature to include a function that formats
a CRD into a document, injecting separate functions for formatting the
CRD as YAML and as a docs page.
- Add Makefile targets for building the docs plugin and generating CRD
docs.
To display the resulting reference pages in the docs, this change
configures `docs/config.json` to generate the Reference section of the
sidebar from the docs directory. This requires moving the Helm reference
includes directory into `docs/pages/includes`.
* Respond to hugoShaka feedback
- Do not display the `status` field.
- Indicate that enum fields can take an integer or a string. This is
consistent with our comment conventions, which describe both the
integer and the string values for each enum option.
* Sort CRD reference page sections
Also handle duplicate page sections by including the names of parent
properties within section headings.
* Fix crdgen Makefile targets
- bring test data and hack out of `lib/`
- fix broken debug builds
- add crd-docs checks to the `crds-up-to-date` target
- trigger proto lint on CRD and CRD doc changes
- removed stale gitkeep in `docs/pages/includes/crd-docs/.gitkeep`
- split crdgen formatting logic in another file for readability
- update license header years on new files
* fixup! Fix crdgen Makefile targets
* lint files due to false positive 'generated' comment
* fixup! lint files due to false positive 'generated' comment
* Incorporate rosstimothy feedback
Remove an unnecessary package.
Also regenerate the CRD docs.
* fix debug builds and gitignore
* fixup! fix debug builds and gitignore
* Respond to rosstimothy feedback
Fix integrations/operator/crdgen/Makefile
* Fix spelling
* Fix flaky propertyTable test
Compare the unsorted slice elements, since sorting takes place on the
containing VersionSection.
---------
Co-authored-by: hugoShaka <hugo.hervieux@goteleport.com>
* Add `terminal.windowsUseConpty` config option
* Calculate `windowsPty` options
* Pass `useConpty` to node-pty
* Pass `windowsPty` to xterm
* Fix test
* Replace `terminal.windowsUseConpty` with `terminal.windowsBackend`, pass boolean all the way through
* Wait for pty processes to exit before closing the app
* Simplify `Array.from`
* `GRACEFUL_KILL_MESSAGE` -> `TERMINATE_MESSAGE`
* Adjust callsites to async `dispose`
* Add `winpty` to ignored words in `cspell.json`
* DocumentDB guide
* update diagrams and add screenshots
* fix img link
* review comments
* address comments from Paul
* add docdb and sasl to spelling
* Add custom DNS zone docs for VNet
* Link to VNet guide from web and TCP guides
* Add info about IPv4 CIDR range
* Add VNet config to resource reference
* Reword the first part of "How it works", use concrete example
* Move first uses of Var to Prerequisites
* Add dscacheutil instructions to end user docs
* Auth Server → Auth Service
* Mention HTTP APIs, clarify HSTS issue
* Correct info about IPv4 ranges
* Mention multiple TXT records on single domain
* Mention vnet.mdx in guides.mdx
* Add dscacheutil and osconfig to cspell
* Fix link to headers passthrough
* Fix yet another link
* Add initial structure of AWS roles anywhere guide
* More progress on roles anywhere guide
* Add more advice on SPIFFE ID structure
* Add guidance on updating user or bot roles
* Finish off AWS roles anywhere guide
* Fix broken link to AWS RA guide
* Missing `the`
* Add `rolesanywhere` to cspell
* Update docs/pages/machine-id/workload-identity/aws-roles-anywhere.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/workload-identity/aws-roles-anywhere.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove mentions of App Access for AWS
* Refer explicitly to Teleport Proxy Service
* Add how it works header
* Make deciding SPIFFE structure part of pre-requisites
* Update docs/pages/machine-id/workload-identity/aws-roles-anywhere.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/workload-identity/aws-roles-anywhere.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add end user docs for VNet
* Adjust copy of osascript and VNet panel
* Address lint errors
* Add section about connecting without VNet
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* Log in to the cluster -> Log in to your Teleport cluster
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Try connecting to the app without VNet → Connecting to the app without VNet
Also, reformat section.
* Explain benefits of VNet without mentioning earlier Teleport versions
* Explain in Connect docs when to use VNet vs local proxy
* Add vnet to known words, fix typo
Otherwise spell check complains about vnet in links.
* web and TCP apps → TCP apps
* Add intro paragraph
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update link to VNet docs
---------
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
