* Update the teleport-kube-agent reference
Fixes#17578
Document values fields and behavior introduced by #13942.
Since the teleport-kube-agent chart now deploys more resources--and
deploys them based on more sophisticated logic--this change lists the
resources deployed by this chart and describes the conditions in which
this chart deploys them.
* Respond to PR feedback
- Fix the legacy behavior description at the top of the refernece. Also
add this to its own H3 since it is getting a bit lengthy.
- Note that *-hook resources are removed after the upgrade finishes.
- Note that `serviceAccountName` is deprecated and expand the
`serviceAccount.name` entry a bit.
- Add a note re: storage not being required to the "New chart
installations" section.
- Clarify `storage.enabled` in relation to upgrades
* format tables
* add br tags to service table
In order to display the service name without a line break mid-word.
* adjust br tag placement
To avoid breaking the first column
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Add clarification as to the purpose of Metrics endpoint.
Added paragraph explaining purpose of Metrics endpoint, along with
suggested solution for capturing usage data.
* PR Feedback.
1. Adjusted verbiage.
2. Removed ScopedBlocks.
3. Linked to Elastic instructions.
Closes#14578
The Jira Cloud guide applies to all Jira deployments already, so we
don't need to maintain separate guides. This change renames the Jira
Cloud guide so it's about Jira in general.
* Add callouts to docs and Helm values for Kubernetes 1.23+ on EKS
Kubernetes 1.23 introduced a requirement for EKS clusters to use a CSI (container storage interface) driver addon to provision EBS volumes as persistent volumes. Kubernetes 1.23 is now the default for new EKS clusters and since our chart uses persistence in its default mode, it will fail to deploy on EKS without this additional driver being installed.
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update teleport-kube-agent readme
* Add values.yaml and schema changes for azure dbs
* Add azure discovery helm lint
* Add azure discovery helm tests
* Fix schema and update snapshot
* Update lint
* Update helm chart docs reference
* Update readme
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
* Move yaml lint note to include snippet
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Add azureDatabases to list of required resources for db role in docs
* Update readme to link to docs
* Provide complete example yaml for azure db discovery helm chart
* s|dbResources|databaseResources|g in helm chart reference
* Remove --set tabs for aws and azure databases from chart reference
* Update lint to use secret as example too
* Update azure db discovery helm chart snapshot
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/reference/helm-reference/teleport-kube-agent.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Remove shell vars in readme since we dont provide a command
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
This contribution adds the following feature
- support for `joinParams` value to join using EC2 and IAM tokens
The PR contains the following fixes
- Fix previous secretName documentation that was incorect
- Reword authToken and joinParams documentation to explicit how values interact together
- Add unit test with `joinParams.method = token`
- Add unit tests checking secret creation
- Mark joinParams.method mandatory in JSONSchema
- Always use join_params to pass tokens
* Document requirements for IAM joining
Co-authored-by: Guilherme Sponda <sponda@archlinux.com.br>
Co-authored-by: Guilherme Sponda <guilherme.sponda@audibene.de>
* Enhance diagnostics docs
The diagnostics docs were all in one page(`setup/reference/metrics.mdx`)
which made things a bit hard to find, and wasn't conducive to adding
new content.
Diagnostics information is now located at `setup/diagnostics` with each
section from the original `metrics.mdx` doc now having its own dedicated
page. The section will now show up in the navbar at
"Setup" > "Monitoring Your Cluster".
The content of the profiling page is expanded to include information from
https://github.com/gravitational/teleport/blob/740d184d1cfc69ae2e96c50ee738b13884fb232b/assets/monitoring/README.md#low-level-monitoring
to illustrate what the different profile types are, the information that
they capture, and how to retrieve them.
A new Distributed Tracing page is also added to instruct users on how to setup
the `tracing_service` to collect and export spans (the last open item
for #12241).
Two links didn't render correctly and preserved the ".mdx" extension,
causing 404s for crawlers. This removes the scope param to get link
rendering to work.
* Revert "Azure AD authentication for the Postgres backend (#15757)"
This reverts commit 33c6d82dc3.
* Revert "SQL Backend (#11048)"
This reverts commit 06fef2abf1.
* Remove Postgres backend from the docs
* Remove the Postgres backend from the testplan
* Predicate expressions using the "name" identifier will now use
field "hostname" when `ls` querying for nodes, as expected by
the user
* Change predicate expression for access request that use
name identifier to using the actual json field names
When assigning AWS IAM permissions to Teleport, `eksctl create iamserviceaccount` command manages the ServiceAccount lifecycle.
This PR allows any user to configure an existing Kubernetes ServiceAccount used by the agent.
Part of #11866
* Leverage inventory control stream for instance version metrics
The version metrics relied on loading all resources in the cache on
each auth server to tally the counts. Unmarshalling items from the
cache can be quite expensive, especially when done every 15s for
all resources in a cluster. While auth servers are typically robust
machines the extra computation for calculating a single metric is
a bit costly and will grow with the cluster size.
Now that the inventory control stream provides a simple and efficient
manner to iterate over all connected instances we can leverage it
instead of the cache to calculate the version counts. This is a slight
breaking change however, as an auth server will now only be reporting
the versions of instances connected directly to itself, and not
versions for all instances within the cluster. This can easily be
worked around by aggregating the metric from all auth servers for
a cluster.
Closes#16429
Fixes#13129
This PR sets minReadySeconds to 15 by default. During a rollout we still have proxies that don't have tunnels to all agents, but at least agents don't end up with 0 active tunnels.
* Refresh the Enterprise Getting Started guide
Fixes#14249
Edit the Enterprise Getting Started guide based on manual testing to
make the guide up to date and easier to follow.
- Update the architectural description in the introduction
- Structure the guide, following out Linux Server guide for open source
installations, to include Application Access
- Add DNS instructions rather than using the `--insecure` flag
- Add copy-pastable installation instructions
- Flesh out the license file instructions and add a screenshot of the
customer portal
- Simplify the instructions for adding a local user
- Remove the docker-compose instructions, since we want the user to
finish setting up a minimal Teleport cluster by the end of the guide,
and these instructions begin a new step-by-step sequence. We also have
a separate docker-compose guide that users can follow for a local
demo
- Add a "Next steps" section and move relevant content there
* Respond to PR feedback
Prior to this change, the only place you could find a complete IAM
policy for using S3 to store session recordings was in the helm
deployment section.
Move the IAM policy into an include so that we can also include it
in the S3 section of the backends reference page.
Provides a solution for #9298
This removes an unnecessary limitation of the Helm chart: `.Values.tls.existingCASecretName` can now be used without `.Values.tls.existingSecretName`. This allows users to trust their own CAs without building custom images.
Context:
- go's x509 library supports loading system certs based on the SSL_CERTS_FILE environment variable
- we are already using this in the chart to trust private CAs (teleport proxy needs to trust its own certs to start)
- users might want to trust custom CAs to
- speak with a S3 backend (minio)
- validate upstream app certs (unlike DB access you can't trust certs per-application)
- trust another cluster
- call an OIDC provider
- teleport-kube-agent chart already has the feature
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* note S3 versioning requirement
* expand from input on GH
* copy edits after talking with Jeff
* Update docs/pages/reference/backends.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add documentation for Jira Helm chart
It includes an updated guide and the reference of the new Helm chart.
* Fixed some minor mistakes in the guides
* Reorganized Helm related examples
* Fixed a few minor mistakes
* Alphabetized jira.* settings
* Renamed Cloud to Executable in Testing
* Extended YAML config example with explanation
* Edit Jira Access Request plugin Helm chart docs
- Edit the configuration instructions so we don't instruct Helm users to
use the `configure` subcommand. Also use the `Tabs` component's
dropdown functionality so we can include both self-hosted and Teleport
Cloud instructions for Helm and VM users.
- Minor style tweaks.
* Add Helm Chart example to Installation section
* Removed confusing (and broken) link
git push
* Fixed wrong default value
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Marco André Dinis