* Edit DNS guidance for registered apps
Closes#30361
Add an explicit warning against creating DNS records that map
application subdomains to the hosts of registered applications. Use the
`dns-app-access` partial in `connecting-apps.mdx` to simplify reuse.
* Respond to zmb3 feedback
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Include inlining the partial:
docs/pages/includes/machine-id/recover-circle-ci-claims.mdx
This is because it's only used by two pages and, as a partial, violates
the rule in which each Var with a given name must be used multiple
times on a single page. Since this Vale rule uses the `raw` scope, it is
not possible to ignore it with an MDX comment.
The guide now reflects that rolling Auth upgrades are allowable in
certain scenarios. The guide also explicitly calls out when client
tools should be upgraded.
* Reorganize the feature matrix
This change organizes the feature matrix according to the latest product
categorization scheme, and moves the feature matrix into its own guide
to make it more discoverable. While there is opportunity to rework the
rows within the feature matrix, this change minimizes the scope of the
first iteration by reorganizing the existing rows while leaving them for
the most part unchanged.
In the new feature matrix page, each Teleport product has its own
H2-level section. Product descriptions come from official Marketing
language, focusing on concrete statements about what each product
comprises and how it works and leaving out statements of value (which
are not typically found in documentation). This change does not include
sections for categories with no rows in the current table.
* Respond to zmb3 feedback
Add minor wording tweaks.
* Align cells across feature matrix tables
Make it easier for a user to follow a single column across multiple
tables of the feature matrix. Since the style sets cells to 25% width,
which assumes a table that is four cells wide, use a `style` tag so the
style only applies to the tables in the `teleport-editions.mdx` guide.
Closesgravitational/docs-website#134
* Update the MWI section of the feature matrix
Indicate that it is available for Community Edition users.
* Edit index.mdx
Apply changes made to identical language in teleport-editions.mdx.
* Respond to eglenn-teleport feedback
- Move the Community Edition column to the final place, rather than the
first, since we now want to de-emphasize Community Edition and elevate
the commercial offering.
- Edit the text to de-emphemphasize "editions", moving the description
of editions to the end of the page and linking to this from the
heading of relevant feature matrix columns.
- Remove section intro paragraphs, since the same information is
on the home page of the docs.
* Add a Teleport Identity Security section
Co-authored-by: Ben Arent <ben@goteleport.com>
* Rename MWI features
---------
Co-authored-by: Ben Arent <ben@goteleport.com>
See gravitational/docs-website#91
Docusaurus uses semantic HTML tags instead of a custom Details
component. Replace instances of our Details component with the
`<details>` and `<summary>` tags so we do not need to perform a
conversion when building the docs website.
Closesgravitational/docs-website#70
`Tabs` components that use a dropdown menu do not render on the
Docusaurus site. Since there are not many of these in the docs content,
it makes sense to change them to standard `Tabs` components instead of
porting the legacy `Tabs` behavior to the new Docusaurus site.
- Change long picker partials to use a standard `Tabs` component instead
of a dropdown menu. While this is not ideal, it standardizes the
`Tabs` component in the docs to only use attributes that the docs
engine can process. All `TabItems` render as expected.
- Remove an unused partial that uses two-dimensional `Tabs`
(`docs/pages/includes/install-linux-self-hosted.mdx`).
- In some guides, collapse two-dimensional `Tabs` components to only
require one dimension.
- In `install-linux-enterprise.mdx`, use the one-line installation
script to simplify the instructions and avoid using `Tabs` entirely.
The docs engine strips these, so they are no op. Remove them so we can
remove the docs engine code that strip them. As part of this, remove the
`icons-table.mdx` partial, which no pages include.
See gravitational/docs-website#95
The docs engine currently unwraps them, meaning that they are no-op
components. Remove these so we can delete the Figure-unwrapping code.
The PKCS#11 that we use defaults to allowing 1024 concurrent
sessions. If an HSM is configured with a lower limit it results in
broken UX since the PKCS#11 library does not reuse open and available
sessions until it has opened the maximum number of sessions that it
can. While the library behavior is out of our control, we now allow
users the ability to specify what their desired max and propagate it
on to the PKCS#11 library so that it will not open more sessions
than the HSM will allow.
The auth config reference was updated to include `ca_key_params`.
While these config options were somewhat discoverable via individual
HSM guides, they were not mentioned in the auth reference.
Use Docusaurus syntax for admonitions so the docs engine does not need
to replace these. This is one step toward removing the
`remark-update-tags` plugin. See: gravitational/docs-website#94
Relevant commands are included below to make reproducing this work
easier.
1. Replace all `Notice` tags with `Admonition` tags.
2. Add `type="info"` if an Admonition is missing a type.
To find instances:
```
find docs/pages -name "*.mdx" -exec awk '
BEGIN{a=0}
a==0 && /<Admonition/{ a = 1 }
a==1 && /type/{t = 1}
a==1 && />/{ a = 0; if(t == 0) print FILENAME ":" FNR }' {} \;
```
3. Replace `type="notice"` with `type="note"`.
To find instances:
```
find docs/pages -name "*.mdx" -exec awk '
BEGIN{a=0}
a==0 && /<Admonition/{ a = 1 }
a==1 && /type="notice"/{t = 1}
a==1 && />/{ a = 0; if(t == 1) print FILENAME ":" FNR }' {} \;
```
- Fix "Auth Service" variations.
- Fix some AWS product naming violations.
- Ignore some false positives.
- Fix capitalization warnings.
- Address warnings re: outdated product names.
Some of the warning categories above include auto-generated pages. This
change does not touch the generators in order to simplify things.
Update the guide for Teleport v17 based on manual testing.
- Ensure that variable names are consistent.
- Update images
- Update link targets
- A couple of minor readability improvements
* Move `CertificateTTL` and `RenewalInterval` into a `CertificateLifetime` struct
These values are always required together, and moving them into a struct will
make it more straightforward to override them per-service/output.
* Support custom `certificate_ttl` and `renewal_interval` on identity output
* Support custom `certificate_ttl` and `renewal_interval` on application output
* Support custom `certificate_ttl` and `renewal_interval` on application tunnel
* Support custom `certificate_ttl` and `renewal_interval` on Kubernetes output
* Support custom `certificate_ttl` and `renewal_interval` on Kubernetes V2 output
* Support custom `certificate_ttl` and `renewal_interval` on database tunnel
* Support custom `certificate_ttl` and `renewal_interval` on SSH host output
* Support custom `certificate_ttl` and `renewal_interval` on SSH multiplexer
* Support custom `certificate_ttl` and `renewal_interval` on SPIFFE SVID output
* Support custom `certificate_ttl` and `renewal_interval` on database output
* Support custom `certificate_ttl` and `renewal_interval` on workload API
* Support custom `certificate_ttl` and `renewal_interval` on workload identity output
* Add `GetCertificateLifetime` to service config interface
* Update the docs
* Add more examples to the standard config
* Rename `CertificateLifetime` to `CredentialLifetime`
So it can be used for non-certificate credentials like JWTs
* Deprecate `certificate_ttl` option and replace it with `credential_ttl`
* Return TTL warnings as errors and let the caller decide what to do with them
* Add `CredentialLifetime` to the "full" service config tests
* Support `credential_ttl` and `renewal_interval` in workload-identity-jwt service
* Silence sloglint
* Replace duplicated helper with `cmp.Or`
Fixes#51181.
K8S `Role` & `RoleBinding` are created by default. Their creation does not depends on the `ServiceAccount` creation anymore.
Co-authored-by: maximumG <maxime.gerges@backmarket.com>
* Stable user UID addition to the host user creation guide
* tctl stable-unix-users-ls docs
* CAP resource reference
* auth service reference
* Uncomment defaulted field in fileconf
* Clarify conditions for stable uids
Closes#29347
The guide currently illustrates how to assign roles to new local users.
This change uses the `add-role-to-user.mdx` partial to include
instructions for Teleport clusters with SSO authentication connectors.
It edits the partial to include a parameter for the name of the user.
* Add CLI reference
* Start fleshing out pages for new docs
* Link out to Terraform provider information
* Start putting together workload-identiyt-api svc reference
* Minor adjustments
* Keep hacking on reference for resource
* Keep hacking on reference
* Add to list of templating supported fields
* Add TOC
* Add rules to the example yaml
* Flesh out workload-identity-api docs page
* Add some todos
* Add skeleton of attributes page
* ADd comments
* Cross page links
* Retitle page
* Link one reference to another
* Add template for selector
* SPAG
* Fix link
* Fix TODO link
* ADd tbot start workload-identity-jwt to cli reference
* Add `workload-identity-x509` to config reference
* Start documenting join attributes
* Finish last batch of join attrs
* Add some short exsplanations/summaries
* Start explaining rules
* Shorter explanation
* Add opener to Workload Identity API and Workload Attestationreference
* SPAG
* Add docs for selector
* Fill out migration guide
* rename/reorg
* Add short note on SPIFFE Workload API
* SPAG
* Fix links
Moderated sessions are a bit confusing because we combined an existing
OSS feature (joining sessions), with an Enterprise-only feature
(requiring session join policies).
I've expanded the scope of the moderated sessions guide to make it a
"joining sessions" guide instead, and added some extra details around
RBAC for active sessions.
Updates #51116
* kube-agent-update: Use the RFD-184 webapi proxy update protocol by default when possible
* Update integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* log update group
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Marco Dinis