* Replace multi-line ScopedBlocks with Tabs
Contributes to #30268
The documentation scope switcher tends to confuse users, and the
ScopedBlock component hides docs content based on the scope switcher. To
help remove ScopedBlocks from the docs site, this change replaces
multi-line ScopedBlocks with Tabs components if they include variations
for different scopes.
While most multi-line ScopedBlocks function like Tabs, there are a few
edge cases, which this change addresses individually.
Note that this change does not intend to remove all ScopedBlocks that
are placed inline within a paragraph. That will be the goal of a
separate change.
* Remove more ScopedBlocks (#30623)
This builds on the work done in #30616 and contributes to #30616.
Fixes#29957
Improves the page load performance of our CLI reference documentation by
splitting up the long CLI reference page. This also has other benefits,
including:
- **SEO**: Users don't need to search for the Teleport CLI reference
(and don't need to know that this page exists), but can search for a
specific tool they want reference docs for.
- **In-page search:** Users searching within a specific page will get
results for the tool they are researching, not all of Teleport's CLI
tools.
* Add Kubernetes/Helm instructions to the RDS guide
Closes#27753
Add "Kubernetes" tabs as counterparts to Linux host instructions,
following the structure we have used in Access Request plugin guides:
where we show how to install Teleport on a VM, include `helm repo add`
instructions. And when we show how to run a Teleport service, include
`helm install` instructions.
In this guide, I've hardcoded a Teleport configuration file in order to
run `teleport db configure bootstrap`, then inserted the config file
into a Helm values file.
This change also includes instructions to use a local `teleport` binary
in order to bootstrap IAM resources.
This also adds minor formatting and readability changes, e.g., the `Var`
component.
* Respond to alexfornuto feedback
* Update docs/pages/database-access/guides/rds.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Fix linter warnings
* Add Service Account IAM instructions
Frame the guide around authenticating the Teleport agent pod's service
account via the IAM OIDC provider.
* Respond to stevenGravy feedback
* Minor tweaks
- Ensure `Var` names are consistent
- Use obviously fake values for resource URIs
- Use the correct value for the OIDC issuer ID
* Respond to alexfornuto feedback
* Fix spelling
* Fix linter issues
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* update tsh db resource selection
* add --labels and --query to tsh db subcommands
* tsh db [login | logout | env | config | connect]
* tsh proxy db
* add hasPrefix to predicate lang
* add teleport.dev/discovered-name
* print "discovered name" of databases discovered by discovery service,
which is the name of the database resource in the cloud, when using
tsh db ls without --verbose flag. This avoids printing verbose
uniquely identifying names when discovery service is updated to append
a uniquely identify suffix to discovered databases in AWS/Azure/GCP.
* tsh db ls --verbose ignores the label
* fix db connect string in tsh db ls
* select database by prefix, labels, and/or query predicate.
* chooses active database by exact match if the "prefix" matches exactly
and no labels/predicate is given.
* logout of a subset of databases with tsh db logout.
* print an "ambiguous match" error if prefix/labels/query matches
multiple databases where one is required.
* move all --labels cli flags to cf.Labels from cf.UserHost
* update tsh db tests
* speedup slow tsh db tests
* postgres/mysql profile respect home dir
* rename test cases for consistency
* test database listing uses discovered-name
* test login/env/config/logout with prefix/label/predicate selectors
* test active db filtering logic
* fix tests broken by merge
* Fix lint warning, make these unordered lists
* Change numbered steps, make a couple of edits
* Update the versions mentioned in the upgrade sequence
* Changed to bullets because these aren't discrete steps in the traditional sense
* Remove extra lines
* Fix lint issue
* helm: Add ingress template
* helm: Add ingress support
With the changes introducing automatic websocket upgrades for TLS routing in Teleport 13, we can finally add support for a Kubernetes ingress.
* Remove unnecessary brackets
* Tidying
* Gating
* Fix lint and schema
* Fix lint examples
* Handle wildcards
* Tidy up wildcard support
* Don't add AWS annotations when using ingress
* Update AWS docs to use Ingress/ALB with ACM
* Automatically listens on 443, make values simpler
* Support ingress.spec overrides
* Enable ingress and set spec.ingressClassName
* Update values schema
* typo
* Whitelist 'healthcheck' for spellcheck
* Address Hugo's comments from code review
* Apply Paul's comments from code review
* Few more docs fixes
* Update teleport-cluster reference
* Add values file and fix lint/tests
* Fix docs lint
* Add proxy_service.trust_x_forwarded_for when ingress is enabled and Teleport version >=14
* Fix semver check for pre-releases
* Indent ingress section correctly
* Address docs feedback from Hugo/Tiago
* Add warning about using tsh with ingress
* Fix lint spelling
* Add instructions for checking AWS LB controller installation
* Whitelist ingressclass in spellcheck
* What a stupid error
* Edit forScopes configurations and edit guides
Closes#26500
This change requires merging gravitational/docs#326 to add a Team scope
to the docs.
This updates pages within the docs so that:
- Each page's `forScopes` configuration is accurate, especially with
regard to support for Teleport Team.
- All scoped components match the `forScopes` configuration for each
page. For this, I used the linter introduced by
gravitational/docs#327.
* Respond to alexfornuto feedback
* Promote IAC docs for agents and dynamic resources
Closes#27382Closes#25418Closes#25442
Two aspects of setting up a Teleport cluster are omnipresent in the docs
but never get dedicated treatment:
- Running agents
- Applying dynamic resources
As a result, it is difficult to include discussions about those topics
that are separate from a specific workflow or how-to guide. One glaring
absence has been prominent guidance on using infrastructure-as-code
tools to achieve these tasks.
This change improves the visibility of Teleport's support for
infrastructure-as-code tools by:
- Creating top-level docs sections for running agents and applying
dynamic resources
- Making IAC instructions prominent within these sections
The intention is for readers to become familiar with different methods
of applying dynamic resources and running agents, including how to do
this with IAC, so they can apply this knowledge when reading other parts
of the docs.
As a result, in the docs sidebar, the "Dynamic Resources" section comes
before the section on RBAC, and the "Teleport Agents" section comes
before the sections related to individual Teleport services
("Application Access", "Server Access", etc.).
The new section on dynamic resources also gives us a place to put other
guides to using the Terraform provider and Kubernetes Operator, e.g., if
we add guides to using these tools with popular GitOps platforms.
Likewise, the section on agents gives us a place to put other agent-wide
information, e.g., how to enable an additional Teleport service on an
instance that is already running.
To allow for these changes, I have also made the following, more
tangentially related sidebar changes:
- **Renamed sidebar sections to be noun phrases instead of verb
phrases:** Currently, one half of the sidebar is made of imperative
phrases like "Manage Access" and "Manage your Cluster". This doesn't
really work for the sections on agents and dynamic resources, so I
have renamed these sections for consistency.
- **Moved the "Manage your Cluster" and "Deploy a Cluster" sections**: I
have arranged the sidebar so more basic topics (i.e., those that new
users and experienced users alike will need to be familiar with) are
on the top and more advanced ones are on the bottom.
The other sections that are currently in the first half of the sidebar
are topics that all Teleport users will need to get familiar with,
while day two operations and self-hosted production deployments are
more advanced topics.
- **Edited the landing page:** I have edited the landing page of the
docs to reflect the new sidebar organization. This also makes the page
shorter, simpler, and more opinionated. It spells out a high-level
sequence for setting up Teleport, then provides a list of advanced
topics for further reading.
Links correspond to sidebar sections--as before, I wanted to describe
the topic of each sidebar section so users would know this information
without having to navigate away from the landing page.
* Move the "Dynamic Configuration" section
Make this a subsection of "Manage your Cluster" since it's not
self-evidently clear as a top-level docs section. Users will probably
need an introduction via the "Manage your Cluster" section intro page.
This also reverts some of the more drastic sidebar changes introduced by
the previous commit.
Responds to xinding33 feedback.
* Make IAC learning tracks prominent/hard to avoid
Closes#27751
Responds to xinding33 feedback
The motivation is to be more opinionated about the course that users
take through the docs. We currently recommend two tracks for
self-service users, i.e., the users expected to make use of the landing
page:
- Setting up a toy self-hosted Teleport cluster
- Setting up a Teleport Team/Enterprise Cloud cluster that can
eventually become production ready
By moving the "Get Started" guide to the landing page, we direct users
immediately on to the first track. This change then gives new users a
way to enter the second track from the docs landing page with a
prominent link to the Teleport Team docs.
This change also edits The landing page to direct users who have
completed the getting started experience to instructions for setting up
a pool of agents on Terraform, helping to make infrastructure-as-code a
first-class citizen of the docs.
This change also removes the menu of links that used to confront users
on the landing page. Since all sidebar sections include introduction
pages, users interested in the content of a sidebar section can visit
the section. By removing links, we make it clearer for users how to
proceed through the docs.
* Fix linter errors
* Incorporate Trivy recommendations
* Respond to alexfornuto feedback
* Restore list of dynamic resources to the reference
* Fix linter warnings
* Remove the ".sh" extension from userdata script
The Terraform module that reads this file does not need the extension,
which was causing trouble for our shellcheck linter.
* Use teleport.example.com as the example proxy
* Add the core Jamf guide steps
* Add sync schedule optional section
* Add the multiple sources optional section
* Add the auto-enrollment guide
* Add the Jamf service reference config
* Add words to cspell.json and sort it
* Use `--config` instead of `-c`
* Apply Alex's suggestions
* Add preview admonition to auto-enrollment.mdx
* Add scopes for auto-enrollment guide
* Add scopes for jamf-integration guide
* Remove "and restart" from Auth update instructions
* Auth restart instructions
* s/Jamf service/The Teleport Jamf service/
* Use an inline code block for external links
* s/the following/the following keys/
* Use inline code block for key names
* Use inline code block for key names
* Use inline code block for key names
* Use inline code block for key names
* Mention "local workstation" after we transition from Jamf to Teleport
* Mention Jamf service host when switching context
* Use `(=presets.tokens.second=)`
* Use `(=presets.ca_pin=)`
* Mention logs example explicitly
* Add a missing comma
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Address Alex's comments
* Reflow text
* Remove redudant tsh prereqs sentence
* Add a registered device to auto-enrollment prereqs
* Use headers instead of bold
* Use a narrower image for jamf-setup-2.png
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Closes#14788
The description of the `disablesse` S3 backend setting implies that this
setting disables server-side encryption, when it actually stops the Auth
Service from enabling SSE on a per-operation basis.
Also clarify the relationship between `disablesse` and `sse_kms_key`.
* Add reviewer and requester roles.
Reviewer and requester roles have been added to allow for easy defaults for
reviewing and requesting applications and user groups for the Okta service.
* Update comments, add in requester/reviewer references all over docs.
* Update constants.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Better names in resource-requests.mdx, no options for reviewer/requester presets.
* Add dbreviewer to cspell.json.
* Update init_test.go to handle the new number of presets.
* Remove access review/request role creation from resource-requests.mdx.
* Improve wording.
* Only add reviewer/requester/group access if in enterprise.
* Docs updates.
* Remove errant scoped block.
* Tune access controls getting started.
* Prevent customer roles from being overwritten by new defaults.
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* Doc updates, function name updates, bootstrap label behavior changes.
* Adjust TeleportManagedLabel comment to sound less dire.
* Remove unnecessary references to reviewer/requester in the docs.
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Docs tweaks, removal of unnecessary login setting.
* Use internal resource type as discussed offline.
* Update api/types/constants.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* docs: provide information on local user locks from login attemps
* Update docs/pages/reference/authentication.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* header update
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* user variable use
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* verbiage change
* fix file reference
* Change to blocked instead of locked
* Correct words
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Closes#25170
Since we want to keep docs on configuring Teleport's backends within the
Backend Reference, add a Notice to this reference in the DynamoDB
section.
Closes#13571
The instructions for the `cert-format` flag of `tsh` commands are a bit
vague in the CLI reference. While #19041 already fixes the `oldssh` flag
value, it's still unclear how `tsh` uses this flag. This change adds
more information. While #13571 indicates that `cert-format` is not a
true global flag, it is still a flag of the `tsh` command (not a
subcommand), so it makes sense to retain it within the "Global flags"
table.
* Refresh port descriptions
Closes#22839
Clarify that agents do not need to have ports open to the public
internet. Also update the networking guide's use of Teleport terms,
e.g., replacing "Node" as appropriate, and separate Auth Service ports
from Proxy Service ports in the "Self-Hosted" tab since production
deployments may run these services separately.
* Respond to strideynet feedback
* Respond to strideynet feedback
* Simplify Application Service paragraph
* Add docs for shell completion
* Address Zac's comments
* Apply suggestions from Alex
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Do not mention bash_profile
* update cspell
* Remove 'After that'
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
GCS does not implement the S3 multipart API, so we emulate it
by uploading parts and manually "completing" the upload.
The delete permissions is required in order to assemble the
individual parts.
remove the comment saying Teleport won't start without the Firestore backend existing. This is wrong and contradicted by the first bullet point below the example
Closes#12575
Edit the CLI reference to indicate that `tsh ls` can support multiple
label argument values, resolving a longstanding TODO.
Co-authored-by: Steven Martin <steven@goteleport.com>
Noah Stride