* Add a guide to writing an Access Request plugin
Closes#22227
This guide uses a minimal working example of an Access Request plugin to
demonstrate some of the key libraries that Teleport makes available to
plugin developers. The guide is based on a 270-line plugin that manages
Access Requests using Google Sheets.
* Respond to hugoShaka feedback
* Respond to zmb3 feedback
* Add some minor tweaks
- Update the line of code count in the demo program
- Mention Machine ID
* Respond to alexfornuto PR feedback
* tighten existing audit title in nav
* Move plugin install and config to partials
This move not only consolidates these instructions to a single source of
truth, but also takes the divergent updates from these instructions across
multiple docs.
* init datadog guide
* Update docs/pages/includes/configure-event-handler.mdx
Co-authored-by: Michael Wilson <mike@mdwn.dev>
* respond to review feedback
* add context for Logstash
* add context for Splunk
* update page titles
See https://github.com/gravitational/teleport/pull/21950/files\#r1110311232 for details
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* move link to next steps
* Apply suggestions from code review
* adjust prereqs
* Apply suggestions from code review
* Update docs/pages/management/export-audit-events/datadog.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* appease pointless linter rule
---------
Co-authored-by: Michael Wilson <mike@mdwn.dev>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* SAML identity provider docs.
SAML IdP documentation has been added.
* formatting
* spelling
* Zac's and Roman's feedback.
* Valid config.json.
* Linting updates.
* usr Var component
Adding as a unique commit in case it's not desired
* align output with object name
* Roman's feedback, add in a section for disabling the IdP.
* copy edits
* SAML Grafana guide (#22545)
* init Grafana SAML guide
* respond to review feedback
* Correct entity provider to identity provider.
* Note that HSM is not currently supported.
* Fix link.
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Add steps to create machine-id data dir and systemd enablement
* verbiage update
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Change daemon-reload to enable for systemctl
---------
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Reorganize the config reference
Closes#11253
This change breaks up the config reference by moving each Teleport
service's configuration settings into a separate YAML snippet, and
organizing each YAML snippet into a `TabItem` within a `Tabs` with
`dropdownView` enabled. When Teleport Enterprise Cloud doesn't support a
service, this change adds a `Notice` with a message about Teleport
Enterprise Cloud in the relevant `TabItem`.
I thought this approach would be cleaner than alternatives:
- **Including an H2 for each service:** With this approach, the
configuration reference would be even longer than it is now. With the
approach I'm proposing, readers would navigate to "Reference
configurations", then choose a service from a dropdown menu: much less
scrolling for slightly more clicking.
- **Including another set of `TabItem`s for Teleport editions:** I
thought about adding a `Tabs` with a dropdown option for each Teleport
edition and a horizontal `TabItem` for each service, but this would
require horizontal scrolling and doesn't scale very well.
- **Including horizontal tabs for each Teleport edition**, with an inner
dropdown menu for each Teleport service: There is currently no way to
do this without multiple `Tabs` components, which gets messy quickly.
**Note** that this change does not attempt to copy-edit comments/example
values within the configuration snippets. The scope of this change is
limited only to reorganization.
* Respond to PR feedback
* Update docs/pages/includes/config-reference/instance-wide.yaml
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Respond to PR feedback
Use headings instead of `TabItem`s to split up sections of the config
reference.
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* add device spec docs
* format specifics of key
* add yaml tag
* add collected data
* cli ref update
* Update docs/pages/includes/device-spec.mdx
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* update example
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* Include enterprise for tctl for cloud and ent
* Include enterprise in tctl
* removed enterprise from tsh
* correct labels
* Update commercial-prereqs-tabs.mdx
* Add more info re: AWS credentials to the docs
Closes#2781
- Add a partial for how to provide credentials to Teleport's AWS client.
Since this includes adding environment variables to the file used by
our systemd service, I also created a partial re: how to configure
Teleport's systemd service and added these two partials to the
relevant guides.
- Removed `Admonition`s that link to the docs re: AWS credentials in
favor of the partial above. (The partial links to the Go SDK for AWS
docs for situations where users have a specific use case.)
- Remove mentions of the AWS credential-related config settings from the
Backends reference. The example config snippets don't actually include
the `access_key` and `secret_key` settings, so these are left over
from an earlier version of the guide. While you can still add these
settings to a config file, I thought it would make sense to leave them
undocumented since using an EC2 instance, environment variables, etc.
is the recommended approach.
- Split the S3/DynamoDB sections of the Backends reference into
subsections so the extra authentication info fits a bit better.
* Respond to PR feedback
* Add new partials to the RDS Proxy guide
An issue with `gravitational/docs` caused the docs linter to stop
catching issues for a period of time. Now that we have addressed the
linter issue, this change addresses warnings/errors flagged by the
linter.
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Explain Kubernetes RBAC more comprehensively
Closes#18230
This change explains Teleport's RBAC system in relation to the Teleport
Kubernetes Service. The docs didn't leave me with a readily available
place to put this information, since explanations of Kubernetes-related
role fields are scattered in asides throughout various pages.
As a result, I have added a more comprehensive, focused explanation of
Teleport's Kubernetes RBAC system in two places:
- A new how-to guide for setting up Kubernetes RBAC with Teleport using
a local `minikube` cluster.
- A reference guide that explains the Kubernetes-related fields within a
Teleport role as well as the logic that the Kubernetes Service uses to
evaluate these fields. This replaces the existing Kubernetes Access
Controls guide.
To make room for the RBAC how-to guide, I've reorganized the other
guides into a logical sequence: enabling auto-discovery, manually
registering clusters, and setting up access controls.
I've also edited the Resource Access Requests guides to explain role
fields for the different resources you can restrict access to via
`search_as_roles`, including `pods`.
* Partially respond to PR feedback
- Add `kubernetes_labels` to example snippets
- Rename a misleading H5 in the Resource Requests guide
- Make the description of impersonation more accurate in the Access
Controls guide
- Move a Notice in the Access Controls guide
- Add an example role to the warning re: namespace restrictions in the
Access Controls guide
- Make resource filtering info more accurate in the CLI reference
* Change the RBAC how-to guide
Use Deployments in the demo cluster instead of Pods, showcasing the use
of regular expressions in per-pod RBAC.
This responds to PR feedback.
* Provide an example of internal traits
This responds to PR feedback
* Add notes about regex support
Responds to PR feedback
* Explain multiple values in labels
Responds to PR feedback
* Document progressively enabling access to pods
In response to PR feedback
* unbreak redirect
* copy edits
* more copy edits
* Respond to alexfornuto feedback
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* rename manual to active directory manual
* rename getting started to active directory
* update titles and descriptions
* first draft of non-AD getting started
Note: I have images but did not yet include them in the commit history. No need to bloat the repo if those steps will be invalidated by a new installer
* update draft
* update links for new paths
* Update based on review feedback
* update config reference
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* post-review edits
* note non-AD as enterprise feature
* expand manual AD process adminition
* Apply suggestions from code review
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* disable default services for Desktop node
* document cli access, clarify non-AD listing of hosts
* add join token for new node
* update screenshot for new UI
* copy edit...
Based on https://github.com/gravitational/teleport/pull/19311\#discussion_r1095187559
* name and link for windows exe
* Update download link
* note zip format
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Remove Auth/Proxy instructions from DB guides
Closes#11538
A number of our Database Service guides instruct the user to install the
Auth Service and the Proxy Service. For users who have already set up
these services, these instructions add friction. For users who have
_not_ set up these services, Teleport has existing instructions that
users can follow instead.
This change edits our Database Access guides to require the user to have
a running Teleport cluster as a prerequisite, in line with how-to guides
in other sections of the docs.
Note that, while the issue this change closes is to add Auth/Proxy
Service setup instructions to _more_ places in the docs, this change
follows our style guide recommendation (#20024) to add steps to the
Prerequisites section if we have them documented elsewhere and they
don't directly pertain to the goal of a how-to guide.
* Respond to PR feedback
Change H3s to H2s
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Require a new flag for enabling dynamic resources matching for "tsh db configure create"
* rename flag to --dynamic-resources-labels
* make naming more consistent
* Add device trust documentation
* Link to Device Trust from Access Control pages
* Document `device_trust` authentication section
* Document the `tsh device enroll` command
* Document `tctl devices` commands
* Review: Explain macOS restriction in text
* Review: Address Alex's comments
Indents, markdown style, code block style, punctuation and missing
words.
* Review: Use diff blocks on `tctl edit` example
* Review: Use diff blocks in other examples
* Review: Use standard example names
* Review: Address Alex's comments (2)
Uppercase SERIAL, macOS enroll notice, config example tabs.
* Review: Sort `tctl devices` commands alphabetically
* Review: Use config variables for asset_tag and enroll_token
* Review: Remove '#' from code blocks in cli.mdx
* combine warning and ScopedBlock
A ScopedBlock for OSS will never render on a page not scoped for OSS. This way, it's always visible. Once the feature is out of preview, we can just remove the first line.
* clarify device trust between trusted clusters
This addition dispells any assumptions made by the reader that applying device trust to root clusters would enforece the setting on leaf clusters.
* update enterprise tctl version output
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Update security information in docs.
Update README.md with some updated security and trust information.
Additonally, update SECURITY.md to deprecate our email-based submission process
with our current process via HackerOne.
This change also removes the now-unused PGP public key document.
* Update README.md
Co-authored-by: Reed Loden <reed@goteleport.com>
* Update Teleport download link to current page.
---------
Co-authored-by: Reed Loden <reed@goteleport.com>
* Includes in commericial pre-req to have a enterprise account. Uses includes on how to get a license file.
* Showed how to use the arm version. Removed comment that only x86_64 are provided.
* includes amd64, arm and arm64 include descriptions
* Updates to GCp to show enterprise installation.
* add version compatibility callout to Cloud section
* consolidate partial usage in various guides
* remove partial consolidated into
* Apply suggestions from code review
