* Add a guide to writing an Access Request plugin
Closes#22227
This guide uses a minimal working example of an Access Request plugin to
demonstrate some of the key libraries that Teleport makes available to
plugin developers. The guide is based on a 270-line plugin that manages
Access Requests using Google Sheets.
* Respond to hugoShaka feedback
* Respond to zmb3 feedback
* Add some minor tweaks
- Update the line of code count in the demo program
- Mention Machine ID
* Respond to alexfornuto PR feedback
OSS Teleport supports access requests in a very limited fashion.
Make this clear by adding a separate page that covers the supported OSS
features.
Closes#4818Closes#13175Closes#14889Closes#15979Closes#22587
* tighten existing audit title in nav
* Move plugin install and config to partials
This move not only consolidates these instructions to a single source of
truth, but also takes the divergent updates from these instructions across
multiple docs.
* init datadog guide
* Update docs/pages/includes/configure-event-handler.mdx
Co-authored-by: Michael Wilson <mike@mdwn.dev>
* respond to review feedback
* add context for Logstash
* add context for Splunk
* update page titles
See https://github.com/gravitational/teleport/pull/21950/files\#r1110311232 for details
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* move link to next steps
* Apply suggestions from code review
* adjust prereqs
* Apply suggestions from code review
* Update docs/pages/management/export-audit-events/datadog.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* appease pointless linter rule
---------
Co-authored-by: Michael Wilson <mike@mdwn.dev>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* SAML identity provider docs.
SAML IdP documentation has been added.
* formatting
* spelling
* Zac's and Roman's feedback.
* Valid config.json.
* Linting updates.
* usr Var component
Adding as a unique commit in case it's not desired
* align output with object name
* Roman's feedback, add in a section for disabling the IdP.
* copy edits
* SAML Grafana guide (#22545)
* init Grafana SAML guide
* respond to review feedback
* Correct entity provider to identity provider.
* Note that HSM is not currently supported.
* Fix link.
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* rename manual to active directory manual
* rename getting started to active directory
* update titles and descriptions
* first draft of non-AD getting started
Note: I have images but did not yet include them in the commit history. No need to bloat the repo if those steps will be invalidated by a new installer
* update draft
* update links for new paths
* Update based on review feedback
* update config reference
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* post-review edits
* note non-AD as enterprise feature
* expand manual AD process adminition
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* disable default services for Desktop node
* document cli access, clarify non-AD listing of hosts
* add join token for new node
* update screenshot for new UI
* copy edit...
Based on https://github.com/gravitational/teleport/pull/19311\#discussion_r1095187559
* name and link for windows exe
* Update download link
* note zip format
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Improve the Teleport Cloud Getting Started guide
While following the Teleport Enterprise Cloud Getting Started guide to
test v12, I made the following changes to the guide:
- Change the title of the guide--and language throughout our Cloud
docs--to use "Teleport Enterprise Cloud" instead of "Teleport Cloud".
This reflects the usage in our Core Concepts page.
- Add a brief architectural explanation to the guide in case users
arrive here from a search engine.
- Restructure the guide to include a step to start a local Docker
container. This way, we can (a) ensure that all steps are consistent
for all users; and (b) let the user get started quickly without "real"
infra.
- Include instructions to paste a script generated via Teleport Discover
into the container shell.
- Update screenshots.
* Respond to alexfornuto feedback
* Minor wording change
Responding to PR feedback
* Add a guide to deploying an HA cluster
Closes#16751
This is a general guide that prefaces our HA deployment guides.
Also adds an introduction to the "deploy-a-cluster" section.
* Respond to some PR feedback
- Add mentions of specific services (Auth and Proxy) where it would help
with clarity.
- Edit port tables to remove ports that shouldn't be publicly exposed.
- Clarify the supported backends.
- Clarify that Let's Encrypt is not required for TLS credential
management.
* Respond to more PR feedback
- Add context around DNS records
- Use "Layer 4" instead of "Layer Four"
- Explain optional ports more explicitly
- Fix spacing issues
- Indicate that you can use an S3-compatible object store
- Clarify cert-fetching behavior for applications
- Describe separate port configs depending on whether TLS Routing is
enabled, and add a brief section re: whether to enable TLS Routing
- Expand the Teleport configuration section to accommodate TLS Routing
and separate listeners
* Add more context to the "Deploy a Cluster" intro
* Small language tweaks
* Add an image
* Respond to zmb3 feedback
- Use "cluster state backend" and "session recording backend"
- Mention cross-zone load balancing
- Link to the Backends Reference instead of including example backend
configurations
- Use v3 for example configs
- Fix example config indentation
* Add CTA for Teleport Cloud and forScopes
* Add a guide to exporting events to Splunk
Closes#13158
Since there are multiple guides to exporting audit events now, this also
adds a new section of the docs for these guides.
Also fixes a tiny error in the Elastic Stack guide.
* Respond to PR feedback
* Fix linter issues
* Respond to PR feedback
- Use consistent naming
- Mention the `--ttl` flag for `tctl auth sign`
- Mention Machine ID
- Add a quick Troubleshooting section
- Fix `chmod` command
- Add systemd configs (also added this to the Elastic Stack Event
Handler guide. I didn't do this to the Fluentd guide because the
structure of the guide is different from the Splunk guide's).
* Document Azure CLI access
Closes#17583
- Create a guide to Azure CLI access
- Update references to reflect changes to roles, commands, and the file
config
* Respond to alexfornuto feedback
* Add a section to the guide on `tsh proxy azure`
* Respond to smaller feedback items from Tener
* Switch the order of role approaches
Responds to one item of feedback from Tener.
* Respond to zmb3 feedback
* Document new behavior
- Wildcards in `deny` rules
- The `tsh proxy az` alias
* Add SSO instructions for defining a role
* Update env var values
* optimize images
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
- Fix an incorrect link
- Be more specific about what roles/permissions are required
- Remove some text and an image that didn't meaningfully contribute
* init end user doc
* lint fix
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* simplify inline icon
* incorporate feedback
* Add Kubernetes instructions to the end-user guide (#18234)
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* move to 'connect your client'
* Updates based on review.
* adjust next steps para
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* consolidate tsh examples with Var component
* linting
* Add Kubernetes instructions for the Web UI/Connect (#18611)
* Add Kubernetes instructions for the Web UI/Connect
* optimize images
* add SAML connector to Vars
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* sort list of db guides alphabetically
* add Elastic guide
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* additional edits from review
* add spaces to next steps include
This is so that additional ul items added to a guide using this partial will have consistent spacing
* remove instructions and add tip
Resolves #r995144908 and #r995566035
* fix Database Access config and add scopes
* Move note into relevant tab
* adjust example user mapping
* incorporate more feedback
* incorporate feedback from @tener
* Update docs/pages/database-access/guides/elastic.mdx
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
* bypass linter rule
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Krzysztof Skrzętnicki <krzysztof.skrzetnicki@goteleport.com>
* Refresh the Enterprise Getting Started guide
Fixes#14249
Edit the Enterprise Getting Started guide based on manual testing to
make the guide up to date and easier to follow.
- Update the architectural description in the introduction
- Structure the guide, following out Linux Server guide for open source
installations, to include Application Access
- Add DNS instructions rather than using the `--insecure` flag
- Add copy-pastable installation instructions
- Flesh out the license file instructions and add a screenshot of the
customer portal
- Simplify the instructions for adding a local user
- Remove the docker-compose instructions, since we want the user to
finish setting up a minimal Teleport cluster by the end of the guide,
and these instructions begin a new step-by-step sequence. We also have
a separate docker-compose guide that users can follow for a local
demo
- Add a "Next steps" section and move relevant content there
* Respond to PR feedback
* Add screenshots for azure IAM setup
* Update azure mysql postgres guide to explain discovery
* Update db service config yaml reference
* Update docs/pages/database-access/guides/azure-postgres-mysql.mdx
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
* Fix typo in admonition type
* Redact IDs in azure screenshots
* Clarify that role assignment applies to either principal type
* Advise restarting db service after checking credentials
* optimize images
* Update docs/pages/database-access/guides/azure-postgres-mysql.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/database-access/guides/azure-postgres-mysql.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/database-access/guides/azure-postgres-mysql.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>
Co-authored-by: alexfornuto <alex@fornuto.com>
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Fixes#14576
- Add updated instructions, as the behavior and configuration settings
for the PagerDuty plugin have changed since we first added this guide.
- Ensure the guide can be followed as a set of step-by-step
instructions. For example, this change tells the user to create two
PagerDuty services and refers to these services throughout the page.
- Also edits example configs for the PagerDuty and Mattermost plugins.
* Add a guide to Desktop Access Directory Sharing
Closes#15433
I placed this at the root of `docs/pages/desktop-access` since this
guide is currently the only step-by-step Desktop Access guide aside from
the Getting Started guide, and doesn't quite fit in the "Reference"
section.
Note that the "How it works" section at the bottom of the guide should
probably be in a separate architecture guide to Desktop Access. However,
we don't yet have a Desktop Access architecture guide, and I wanted to
include an architectural description here in case users want to
understand the architecture of the feature for threat modeling etc.
* Respond to PR feedback
* Address PR feedback
* Respond to PR feedback and include updates
- Add an entry in the Desktop Access RBAC guide
- Fix a link
- Include updated notes on the product
Fixes#14577
Update the guide and make it easier to use:
- Give this guide the structure of the Slack guide, adding stepped
headings and a section on configuring Access Requests, to make this
guide easier to follow step by step.
- Add the initial Access Request RBAC setup as a partial
- Indicate that this has been tested with Mattermost v7.0.1
- Add clarity tweaks throughout
- Update the instructions for editing the plugin configuration. The
configuration fields have changed since guide was written.
* Edit the Slack access request plugin guide
Fixes#14581
- Flesh out the intro a bit
- Fix the directory name used in the `mv` command in the installation
step. Also fix the name of the binary generated by the `make` command.
- Add a step to test the installation
- Edit the rbac.mdx and impersonations.mdx partials to provide more
context and restructure the instructions so users can follow them step
by step.
- Add context around other existing steps
- Add more comprehensive role mapping instructions. The guide included
an example role mapping, but did not spell out the general logic of
the role mapping bheavior, e.g., that the "*" key is required.
- Move the step re: inviting the bot to after the user configures role
mapping so they know which channels to invite the bot to.
- Add a section on creating roles to enable Access Requests so it is
eassier to follow this guide linearly. Otherwise, users will need to
do more work to match the configuration instructions with the
specifics of their RBAC setup.
- Capitalize "Access Request" in this and other guides, since we're
adding more emphasis on this as a product.
- Turn the "Audit Log" section into an Admonition and make the
instructions there more accurate.
- Add context to the "identity-export.mdx" partial. This is a pretty
confusing part of the Access Request setup process, so I added context
to explain why different identity file formats are used.
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* Respond to PR review
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Paul Gottschling