* Add slug for self signed certs
* Add self-signed certs guide
* Move tls cert setup into an include snippet
* Update tsh section on self signed certs
* Fix indentation
* Remove extra slash before heading
* Update docs/config.json
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tls-certificate-setup.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Fix formatting of github suggestion commit
* Change link title to avoid abbreviation
* Update intro to explain the purpose of the guide and why anyone would want it
* Make 'proxy' and 'certs' consistent throughout the guide:
certs -> certificates
proxy -> Proxy Service
* Move motivation for guide out of warning and into intro
* Simplify the warning notice
* Change headings
* Capitalize helm and simplify label
* Update Helm info to include inline instructions
* Simplify systemd label
* Update systemd tab
* Update slug certs -> certificates
* Fix include snippet yaml example
* Change prereqs to omit cloud tab and instruct user to check for self-signed certs config
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Get specific about problem caused by insecure TLS
* Remove 'how to setup tls certs' section in favor of a link at the bottom
* Add examples for tsh and tctl, and clean up tctl wording
* Remove link to systemd guide
* Add more detail to systemd instructions
* Change wording around instructions for teleport
* Rearrange links
* Remove reference to deleted acme.mdx
* Remove v2 config reference to auth_servers
* Remove list syntax for proxy_server
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Two links didn't render correctly and preserved the ".mdx" extension,
causing 404s for crawlers. This removes the scope param to get link
rendering to work.
* Revert "Azure AD authentication for the Postgres backend (#15757)"
This reverts commit 33c6d82dc3.
* Revert "SQL Backend (#11048)"
This reverts commit 06fef2abf1.
* Remove Postgres backend from the docs
* Remove the Postgres backend from the testplan
* Predicate expressions using the "name" identifier will now use
field "hostname" when `ls` querying for nodes, as expected by
the user
* Change predicate expression for access request that use
name identifier to using the actual json field names
When assigning AWS IAM permissions to Teleport, `eksctl create iamserviceaccount` command manages the ServiceAccount lifecycle.
This PR allows any user to configure an existing Kubernetes ServiceAccount used by the agent.
Part of #11866
* Leverage inventory control stream for instance version metrics
The version metrics relied on loading all resources in the cache on
each auth server to tally the counts. Unmarshalling items from the
cache can be quite expensive, especially when done every 15s for
all resources in a cluster. While auth servers are typically robust
machines the extra computation for calculating a single metric is
a bit costly and will grow with the cluster size.
Now that the inventory control stream provides a simple and efficient
manner to iterate over all connected instances we can leverage it
instead of the cache to calculate the version counts. This is a slight
breaking change however, as an auth server will now only be reporting
the versions of instances connected directly to itself, and not
versions for all instances within the cluster. This can easily be
worked around by aggregating the metric from all auth servers for
a cluster.
Closes#16429
Fixes#13129
This PR sets minReadySeconds to 15 by default. During a rollout we still have proxies that don't have tunnels to all agents, but at least agents don't end up with 0 active tunnels.
* Refresh the Enterprise Getting Started guide
Fixes#14249
Edit the Enterprise Getting Started guide based on manual testing to
make the guide up to date and easier to follow.
- Update the architectural description in the introduction
- Structure the guide, following out Linux Server guide for open source
installations, to include Application Access
- Add DNS instructions rather than using the `--insecure` flag
- Add copy-pastable installation instructions
- Flesh out the license file instructions and add a screenshot of the
customer portal
- Simplify the instructions for adding a local user
- Remove the docker-compose instructions, since we want the user to
finish setting up a minimal Teleport cluster by the end of the guide,
and these instructions begin a new step-by-step sequence. We also have
a separate docker-compose guide that users can follow for a local
demo
- Add a "Next steps" section and move relevant content there
* Respond to PR feedback
Steven Martin