* Describe node instance usage in AWS Terraform
* Include link to AWS Terraform Guide
* minor wording update
* phrasing update
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* phrasing update
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update language
* Update AWS language
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
An issue with `gravitational/docs` caused the docs linter to stop
catching issues for a period of time. Now that we have addressed the
linter issue, this change addresses warnings/errors flagged by the
linter.
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Explain Kubernetes RBAC more comprehensively
Closes#18230
This change explains Teleport's RBAC system in relation to the Teleport
Kubernetes Service. The docs didn't leave me with a readily available
place to put this information, since explanations of Kubernetes-related
role fields are scattered in asides throughout various pages.
As a result, I have added a more comprehensive, focused explanation of
Teleport's Kubernetes RBAC system in two places:
- A new how-to guide for setting up Kubernetes RBAC with Teleport using
a local `minikube` cluster.
- A reference guide that explains the Kubernetes-related fields within a
Teleport role as well as the logic that the Kubernetes Service uses to
evaluate these fields. This replaces the existing Kubernetes Access
Controls guide.
To make room for the RBAC how-to guide, I've reorganized the other
guides into a logical sequence: enabling auto-discovery, manually
registering clusters, and setting up access controls.
I've also edited the Resource Access Requests guides to explain role
fields for the different resources you can restrict access to via
`search_as_roles`, including `pods`.
* Partially respond to PR feedback
- Add `kubernetes_labels` to example snippets
- Rename a misleading H5 in the Resource Requests guide
- Make the description of impersonation more accurate in the Access
Controls guide
- Move a Notice in the Access Controls guide
- Add an example role to the warning re: namespace restrictions in the
Access Controls guide
- Make resource filtering info more accurate in the CLI reference
* Change the RBAC how-to guide
Use Deployments in the demo cluster instead of Pods, showcasing the use
of regular expressions in per-pod RBAC.
This responds to PR feedback.
* Provide an example of internal traits
This responds to PR feedback
* Add notes about regex support
Responds to PR feedback
* Explain multiple values in labels
Responds to PR feedback
* Document progressively enabling access to pods
In response to PR feedback
* unbreak redirect
* copy edits
* more copy edits
* Respond to alexfornuto feedback
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* helm: disbale PSPs on 1.23 and document PSA usage
In 1.25 Kubernetes removes PSP support, this has 2 consequences:
- Helm will break after upgrading if PSPs are deployed
- We cannot set security policies anymore
This commit documents those two behaviours and makes the chart disable
PSPs on 1.23 and higher to ensure a smooth upgrade path.
* helm: Remove stale 'migrate from legacy charts' guide
* Includes in commericial pre-req to have a enterprise account. Uses includes on how to get a license file.
* Showed how to use the arm version. Removed comment that only x86_64 are provided.
* includes amd64, arm and arm64 include descriptions
* Updates to GCp to show enterprise installation.
* Reorganize early-stage docs sections
Closes#18127
Currently, there are two sections of the docs related to the earliest
stages of setting up Teleport, "Try out Teleport" and "Deploy a
Cluster". While the organization of our top-level docs sections attempts
to correspond to the stages a user goes through when setting up
Teleport, these combine some tasks that should probably be separated:
- **Choosing an edition and deploying a production cluster**: While the
"Deploy a Cluster" section includes our deployment guides as well as
our edition guides, user will likely commit to setting up Teleport
Cloud, Open Source, or Enterprise before they plan a full HA
production deployment.
- **Deploying a production cluster and deploying a small-scale Teleport
cluster:** While the "Deploy a Cluster" section includes the Linux
Server and Digital Ocean 1-Click guides, these two guides are more for
small-scale deployments than full production clusters.
This change improves the early-stage docs experience for new Teleport
users by:
Splitting the "Deploy a Cluster" section
----------------------------------------
The "Deploy a Cluster" section includes subsections related to choosing
a Teleport edition as well as subsections related to deploying a
production cluster. The problem with this approach is that it leaves no
room for adding introductory guides to help users with these two
purposes.
By splitting the "Deploy a Cluster" section into two top-level sections,
one related to choosing an edition and the other to dpeloying to
production, we can add introductory pages that put the subsections of
these sections in context.
_This change accompanies the work on #16751 to write a general guide to
HA Teleport deployments, since the new guide will have a prominent
place in the reorganized "Deploy a Cluster" section._
Adding introductory pages
-------------------------
Sections related to getting started with Teleport, "Try out Teleport"
and "Deploy a Cluster", were missing introductory pages. This change
adds them, and also adds one to the new "Choose an Edition" section.
Moving the Linux Server and Digital Ocean guides
------------------------------------------------
Move these to "Try out Teleport". The Digital Ocean guide didn't fit
with the rest of the deployment guides, since it's not about
architecting an HA deployment.
This is also a better home for the "Linux Server" guide, so this change
moves that as well.
Removing the "getting-started.mdx" page
---------------------------------------
This page is not reachable via the navigation menu.
* Respond to PR feedback
* Respond to PR feedback
Also minor text tweaks
This addresses some observations from @stevenGravy about a couple places
in the docs where Enterprise-specific installation steps are missing.
- Edit the Machine ID Getting Started guide: Use the `install-linux.mdx`
partial for download instructions, since these include instructiosn
for Enterprise users.
- Add Enterprise instructions to Helm guides that only include OSS
installation instructions.
* Add a guide to deploying an HA cluster
Closes#16751
This is a general guide that prefaces our HA deployment guides.
Also adds an introduction to the "deploy-a-cluster" section.
* Respond to some PR feedback
- Add mentions of specific services (Auth and Proxy) where it would help
with clarity.
- Edit port tables to remove ports that shouldn't be publicly exposed.
- Clarify the supported backends.
- Clarify that Let's Encrypt is not required for TLS credential
management.
* Respond to more PR feedback
- Add context around DNS records
- Use "Layer 4" instead of "Layer Four"
- Explain optional ports more explicitly
- Fix spacing issues
- Indicate that you can use an S3-compatible object store
- Clarify cert-fetching behavior for applications
- Describe separate port configs depending on whether TLS Routing is
enabled, and add a brief section re: whether to enable TLS Routing
- Expand the Teleport configuration section to accommodate TLS Routing
and separate listeners
* Add more context to the "Deploy a Cluster" intro
* Small language tweaks
* Add an image
* Respond to zmb3 feedback
- Use "cluster state backend" and "session recording backend"
- Mention cross-zone load balancing
- Link to the Backends Reference instead of including example backend
configurations
- Use v3 for example configs
- Fix example config indentation
* Add CTA for Teleport Cloud and forScopes
* Add a guide to exporting events to Splunk
Closes#13158
Since there are multiple guides to exporting audit events now, this also
adds a new section of the docs for these guides.
Also fixes a tiny error in the Elastic Stack guide.
* Respond to PR feedback
* Fix linter issues
* Respond to PR feedback
- Use consistent naming
- Mention the `--ttl` flag for `tctl auth sign`
- Mention Machine ID
- Add a quick Troubleshooting section
- Fix `chmod` command
- Add systemd configs (also added this to the Elastic Stack Event
Handler guide. I didn't do this to the Fluentd guide because the
structure of the guide is different from the Splunk guide's).
It is a common question from cloud users if/how Teleport provides any DDoS protection. The Cloud team confirmed it leverages AWS Shield for DDoS protection. Adding a small blurb to the security section calling this out in our documentation for reference.
* Add advisory info on enabling dbs with ACM
* verbiage change
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* verbiage correction
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* verbiage update
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Reorganize advistory info in the AWS guide (#19225)
* Reorganize advistory info in the AWS guide
- Add all advisory information about the approach to choose (ACM vs.
cert-manager) before the instructions for each approach. This way, the
user can see all relevant information together before making the
choice.
- To better express that the reader is making a choice between ACM and
cert-manager, turn steps 4a and 4b into a `Tabs` component. To prevent
ugliness caused by having a double-`Tabs` component in the ACM
section, remove the `TabItem` re: using `--set`, since `values.yaml`
files are cleaner, and use only the values file instructions.
* Mention using existing credentials
* Respond to PR feedback
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Closes#18304
- This applies to installing `teleport-cluster`, `teleport-kube-agent`,
and plugins, using the appropriate version variable for each.
- Some pages use the `--teleportVersionOverride` values setting instead
of `--version`. I've replaced this with `--version` for consistency.
Used this `awk` script to find `helm install` instructions that were
missing the `--version` flag:
```awk
find docs/pages -name "*.mdx" -exec awk '
BEGIN{v=0;i=0}
/helm install teleport-/{i++}
/--version \(=/{v++}
END{if(i>0 && i!=v) print FILENAME}' {} \;
```
Closes#9683
To reduce confusion, we should use "set up" as a verb, rather than
"setup", and treat "setup" only as a noun.
Note that one use of the term "setup" as a verb is in the Jira Server
guide, which #17546 intended to remove, but neglected to. This change
removes that instance of "setup" along with the rest of the surrounding
guide.
- Fix an incorrect link
- Be more specific about what roles/permissions are required
- Remove some text and an image that didn't meaningfully contribute
* Remove spaces between scoped blocks
This enables faster regex searching for single scoped blocks, without alternate content for other scopes
* replace single scoped block with details component
By doing this, something remains visible even when the user hasn't selected the Enterprise scope. That way if they forgot to, they still have something visible to expand and get the information they need.
* make single scoped Details blocks scopeOnly=false
That way readers will still know there is content that doesn't apply to the current scope, in case they forgot to select the correct one
* Add slug for self signed certs
* Add self-signed certs guide
* Move tls cert setup into an include snippet
* Update tsh section on self signed certs
* Fix indentation
* Remove extra slash before heading
* Update docs/config.json
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tls-certificate-setup.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Fix formatting of github suggestion commit
* Change link title to avoid abbreviation
* Update intro to explain the purpose of the guide and why anyone would want it
* Make 'proxy' and 'certs' consistent throughout the guide:
certs -> certificates
proxy -> Proxy Service
* Move motivation for guide out of warning and into intro
* Simplify the warning notice
* Change headings
* Capitalize helm and simplify label
* Update Helm info to include inline instructions
* Simplify systemd label
* Update systemd tab
* Update slug certs -> certificates
* Fix include snippet yaml example
* Change prereqs to omit cloud tab and instruct user to check for self-signed certs config
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/management/admin/self-signed-certs.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Get specific about problem caused by insecure TLS
* Remove 'how to setup tls certs' section in favor of a link at the bottom
* Add examples for tsh and tctl, and clean up tctl wording
* Remove link to systemd guide
* Add more detail to systemd instructions
* Change wording around instructions for teleport
* Rearrange links
* Remove reference to deleted acme.mdx
* Remove v2 config reference to auth_servers
* Remove list syntax for proxy_server
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Refresh the Enterprise Getting Started guide
Fixes#14249
Edit the Enterprise Getting Started guide based on manual testing to
make the guide up to date and easier to follow.
- Update the architectural description in the introduction
- Structure the guide, following out Linux Server guide for open source
installations, to include Application Access
- Add DNS instructions rather than using the `--insecure` flag
- Add copy-pastable installation instructions
- Flesh out the license file instructions and add a screenshot of the
customer portal
- Simplify the instructions for adding a local user
- Remove the docker-compose instructions, since we want the user to
finish setting up a minimal Teleport cluster by the end of the guide,
and these instructions begin a new step-by-step sequence. We also have
a separate docker-compose guide that users can follow for a local
demo
- Add a "Next steps" section and move relevant content there
* Respond to PR feedback
Prior to this change, the only place you could find a complete IAM
policy for using S3 to store session recordings was in the helm
deployment section.
Move the IAM policy into an include so that we can also include it
in the S3 section of the backends reference page.
* note S3 versioning requirement
* expand from input on GH
* copy edits after talking with Jeff
* Update docs/pages/reference/backends.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
