* Add more info re: AWS credentials to the docs
Closes#2781
- Add a partial for how to provide credentials to Teleport's AWS client.
Since this includes adding environment variables to the file used by
our systemd service, I also created a partial re: how to configure
Teleport's systemd service and added these two partials to the
relevant guides.
- Removed `Admonition`s that link to the docs re: AWS credentials in
favor of the partial above. (The partial links to the Go SDK for AWS
docs for situations where users have a specific use case.)
- Remove mentions of the AWS credential-related config settings from the
Backends reference. The example config snippets don't actually include
the `access_key` and `secret_key` settings, so these are left over
from an earlier version of the guide. While you can still add these
settings to a config file, I thought it would make sense to leave them
undocumented since using an EC2 instance, environment variables, etc.
is the recommended approach.
- Split the S3/DynamoDB sections of the Backends reference into
subsections so the extra authentication info fits a bit better.
* Respond to PR feedback
* Add new partials to the RDS Proxy guide
An issue with `gravitational/docs` caused the docs linter to stop
catching issues for a period of time. Now that we have addressed the
linter issue, this change addresses warnings/errors flagged by the
linter.
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
The `tsh appps` family of commands is aliased to `tsh apps`, so both
invocations work correctly. The command itself is defined as `tsh apps`,
so this is what appears in the help message.
Update references to `tsh app` to recommend `tsh apps` instead so that
there isn't confusion when browsing `tsh help` and looking for a missing
`app` subcommand.
Fixes#21367
* Document Google Cloud CLI access
Closes#17584
- Add a guide to configuring and using Google Cloud CLI access via the
Teleport Application Service.
- Since we now have three guides to setting up secure access to cloud
APIs, create a new subsection of the "Application Access" docs section
related to cloud provider APIs.
* Respond to PR feedback
- Capitalize "JSON Web Tokens"
- Edit the AWS guide's nav bar entry
- Fix garbled section in the App Access intro page
- Improve the service account name we use in the how-to guide
- Clarify the way the App Service uses a service account
- Add new env vars to the `tsh proxy` command output
- Other small changes in response to suggestions/comments
* Edit instructions for starting the VM
Add instructions to launch a new VM with a service account attached.
This addresses feedback on the PR.
* Use more precise terminology for service accounts
This addresses feedback on the PR
* Add information about `tsh gsutil`
This adds to both the Google Cloud API access how-to guide and the CLI
reference.
* Respond to PR feedback
* use nobr tags
* fix multiline command
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Update security information in docs.
Update README.md with some updated security and trust information.
Additonally, update SECURITY.md to deprecate our email-based submission process
with our current process via HackerOne.
This change also removes the now-unused PGP public key document.
* Update README.md
Co-authored-by: Reed Loden <reed@goteleport.com>
* Update Teleport download link to current page.
---------
Co-authored-by: Reed Loden <reed@goteleport.com>
* Add x-teleport-api-error to reserved headers
* Update app tests for rewritten headers
* Add test case for x-teleport-api-error
* Fix test for XForwardedSsl since it was effectively untested before
* Refactor leaf test to parse the response from dumper app
* Update docs reference reserved headers
* add version compatibility callout to Cloud section
* consolidate partial usage in various guides
* remove partial consolidated into
* Apply suggestions from code review
* Document Azure CLI access
Closes#17583
- Create a guide to Azure CLI access
- Update references to reflect changes to roles, commands, and the file
config
* Respond to alexfornuto feedback
* Add a section to the guide on `tsh proxy azure`
* Respond to smaller feedback items from Tener
* Switch the order of role approaches
Responds to one item of feedback from Tener.
* Respond to zmb3 feedback
* Document new behavior
- Wildcards in `deny` rules
- The `tsh proxy az` alias
* Add SSO instructions for defining a role
* Update env var values
* optimize images
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Add slug for self signed certs
* Add self-signed certs guide
* Move tls cert setup into an include snippet
* Update tsh section on self signed certs
* Fix indentation
* Remove extra slash before heading
* Update docs/config.json
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tls-certificate-setup.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Fix formatting of github suggestion commit
* Change link title to avoid abbreviation
* Update intro to explain the purpose of the guide and why anyone would want it
* Make 'proxy' and 'certs' consistent throughout the guide:
certs -> certificates
proxy -> Proxy Service
* Move motivation for guide out of warning and into intro
* Simplify the warning notice
* Change headings
* Capitalize helm and simplify label
* Update Helm info to include inline instructions
* Simplify systemd label
* Update systemd tab
* Update slug certs -> certificates
* Fix include snippet yaml example
* Change prereqs to omit cloud tab and instruct user to check for self-signed certs config
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Get specific about problem caused by insecure TLS
* Remove 'how to setup tls certs' section in favor of a link at the bottom
* Add examples for tsh and tctl, and clean up tctl wording
* Remove link to systemd guide
* Add more detail to systemd instructions
* Change wording around instructions for teleport
* Rearrange links
* Remove reference to deleted acme.mdx
* Remove v2 config reference to auth_servers
* Remove list syntax for proxy_server
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* transport: Rewrite headers, including JWTs, for websockets.
Applications can otherwise 401 on websocket requests, as they do not
present any authentication headers.
docs: Fix the reserved JWT header name.
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
* Add test for JWT header in websocket apps
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Alex Vandiver <alex@chmrr.net>
* Add Machine ID Kubernetes guide and partial Apps guide
* Small wording tweaks to the k8s guide
* Rename menu titles to match convention
* Fix inaccurate CA cert recommendation on the API access guide
* Tidy up the Kubernetes guide
* Finish up first pass on Apps guide
* Remove empty admonition
* Address review feedback
* Fix doctest lints
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Address a batch of review comments
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Address further review comments
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Fixes#10976
This change helps to remedy two issues with the documentation:
- Much of the documentation was written when Teleport's services
consisted of the Auth Service, Proxy Service, and Nodes/SSH Service.
There are some places in the docs where a reader can mistake the
Node Service to mean "any resource service."
- Users often associate the term "agent" with a daemon that must run on
every host in their infrastructure, and usage of this term can make
Teleport seem more resource intensive than it actually is.
This change corrects mentions of "Node" that stand in for "any service
that access resources in your infrastructure" to account for Teleport's
other resource services. It also replaces mentions of the term "agent"
with "instance," the name of a resource service, or simply "Teleport."
Also edits the "agentless" question in the FAQ to include more detailed
information about each of Teleport's resource services.
This change also does some light copy-editing to correct the
capitalization of service names. It doesn't aim to be comprehensive,
though, since the main purpose of this change is to fix potentially
misleading mentions of "Node" and "agents".
Finally, this change deletes the production.mdx guide, as there is
no way to access this guide due to redirects. This guide includes
some outdated usage of "Nodes".
* Ensure tctl commands include login instructions
See #10192
Add the tctl.mdx partial or a "tsh login" command in some pages that
include example tctl commands. Note that this change does not address
SSO guides, which will be handled separately.
Where a guide requires a complete restructuring to provide full context,
"docs/pages/application-access/guides/connecting-apps.mdx", I've added
"tsh login" instruction above the first tctl command.
* Respond to PR feedback
* Edit tctl instructions to clarify remote login
Closes#11464
- Ensure that all example tctl commands are accompanied either by
instructions to log in to the cluster or the tctl.mdx partial.
- Edit the guides in the Architecture section to remove notes that
tctl can only be used locally to the Auth Service.
- Edit the user-client-rereqs partial to mention tctl for all
editions, since you can log in to tctl remotely for all editions.
Not editing guides where:
- tctl is run via kubectl exec
- tctl is not mentioned in a code block, i.e., only in passing, and
a reader isn't expected to run the command on their own while
following the guide.
- The user is already expected to run tctl on the Auth Service. The
docker-compose Getting Started guide is an example of this.
* Respond to PR feedback
- Provide more context on authenticating with tctl in the CLI reference
- Update the link to more information re: tctl in the architecture
overview, and indicate that tctl users must authenticate.
- Minor tweaks.
* Respond to PR feedback
- Rephrase the authentication paragraph in the Architecture Overview.
* Add notes about wildcard certificates
Guides to getting started with Teleport on various platforms
recommend creating a DNS record for *.teleport.com. It would help
prospective users to know why this is needed. This change adds
context for why Application Access requires a wildcard subdomain.
Fixes#5378
* Respond to PR feedback
- Move information into a partial
- Mention that you can create a DNS A record for each application-
specific subdomain
* Restore DNS-related cloud provider commands
* Standardize ACME instruction details
Our Getting Started guides often include instructions for
configuring Let's Encrypt and ACME before starting
Teleport, but not all of these instructions have the same
level of detail, and some are missing some context around
how Teleport uses ACME and why you need to open port 443 on
your Proxy Service host. This change adds an include that
spells out these instructions and invokes the include in the
appropriate guides.
The intention was to include as much relevant information within
the guides themselves to prevent the reader from having to
navigate to other pages.
Closes#6448
* Respond to PR feedback
- Substitute "proxy" for "node" where it was incorrectly used
- Some small stylistic fixes
- Clarify that "teleport configure" does not write the config
itself
* Add Cloud compatibility notes to guides
Add Details boxes to some guides that do not mention Teleport
Cloud, indicating how each guide relates to Teleport Cloud users.
* Respond to PR feedback
Removes Details boxes unless necessary to warn users of
incompatibility with Teleport Cloud.
Also makes minor stylistic tweaks.
* Update aws-console.mdx
Update the file with additional note under step 3 that the IAM policy must be attached to the worker node group due to multiple issues encountered using annotations
* Update aws-console.mdx
spelling error
* Update aws-console.mdx
move to prereq section as a note
Russell Jones