We often get support requests for help on setting environment variables,
particularly in regards to enabling NLA for Windows desktop access.
Provide some high level guidance for both Kuberenetes and systemd.
Closes#59731
* MWI: Simpler auto-generated `tbot` service names
Today, `tbot`'s automatically generated services names typically contain the
full destination path, or other parameters, making them (A) not URL-safe and
(B) ugly in the Web UI.
With this change, services will be named using a simpler scheme: `<type>-<count>`
For example:
- `application-tunnel-1`
- `kubernetes-argocd-1`
The counter is unique per service type, so the user could see `database-output-5`
and go look at the fifth `database-output` service. It also treats services with
user-chosen names as part of the sequence, so given this configuration:
```yaml
services:
- type: application-output
- type: application-output
name: my-application
- type: application-output
```
The service names would be `appliation-output-1`, `my-application`, and
`application-output-3`.
changelog: MWI: `tbot`'s auto-generated service names are now simpler and easier to use in the `/readyz` endpoint
* Update `/readyz` docs
* Use a `set.Set` instead of a map
* Remove old name validation test
* Fix `TestInitSymlink`
This was failing because calling `CheckAndSetDefaults` on the `BotConfig` was
copying pointers from `Outputs` into `Services`, and then we would marshal and
unmarshal the config to YAML, including "both" entries with the same generated
service name.
* Fix import ordering
Add further explanation on etcd defrag schedules. Note
we cannot provide the exact schedule without cluster metrics
and deployment information. The user is directed to use the etcd
metrics to guide them instead.
Closes#15787
For the most part, all MWI how-to guides that mention
`/var/lib/teleport/bot` include instructions for preparing the storage
directory. This change ensures that they all use a standard partial, and
includes the partial in one guide that is missing it.
Reference that tsh proxy kube supports headless authentication and
add an example showing how to use it. While adding this, it was
noted that the tsh cli reference omitted tsh proxy kube. Since the
headless docs now mentioned tsh proxy kube, the tsh cli reference
was also updated to detail tsh proxy kube to increase clarity.
Using Teleport with infrastructure as code tools is a common use case.
Tag pages with this use case so users can find related pages when
looking for IaC content.
* First round of changes to Getting Started guide based on UX testing
* SPAG
* Fix spacing?
* Server -> Service
* Update docs/pages/machine-workload-identity/getting-started.mdx
Co-authored-by: Dan Upton <daniel.upton@goteleport.com>
---------
Co-authored-by: Dan Upton <daniel.upton@goteleport.com>
* docs: clarify cluster upgrade process
When we removed the requirement to scale auth servers down to 1
instance as part of cluster upgrades, we placed new rules on
agent upgrades. This docs change attempts to clatify the requirements,
namely that agents don't get ahead of proxy/auth.
- Auth servers must be upgraded first. You can upgrade them as quickly
or slowly as you want, but don't start upgrading other components
until all auth servers are running the new version.
- Proxy servers get updated next. Upgrade them to the same version
that auth was just updated to.
- Agents get upgraded only after auth and proxy are all running the
new version. Same thing goes here - the agent should be upgraded
to the same version that you just upgraded the control plane to.
* Apply suggestion from @rosstimothy
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
* Apply suggestion from @rhammonds-teleport
Co-authored-by: rhammonds-teleport <ryan.hammonds@goteleport.com>
* Be more explicit about upgrade order and versioning
Proxy should never exceed auth.
Agents should never exceed proxy.
---------
Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: rhammonds-teleport <ryan.hammonds@goteleport.com>
* Chart yaml, values and helpers
* address comments
* autogenerated reference docs
* add missing extra labels and annotations for the service
* admonition formatting
* version and image helpers
* join secret name helper
* resources
* update reference
* add linting
* Add helm unittests
* Allow custom key for the trusted CA bundle secret
* Remove check for negative replicaCount value
* Clean up .lint/full.yaml and fill it in a bit more
* Fix selector labels indentation in PDB
* Redo tests avoiding snapshots
* Update exercise-configmap to render the whole chart for linting
* Update OIDC SSO docs to describe new 'request_object_mode' which enables signed JWT-Secured Authorization Requests on OIDC connectors.
* Describe how to retrieve oidc_idp public key via tctl.
* * Add a few words explaining that request objects can also be configured for MFA checks.
* Fix heading capitalization.
* Document release versions where request object support is introduced.
* MWI: Add Ansible AWX access guide
This adds a guide for accessing nodes via tbot in Ansible AWX.
* Add tbot config
* Add missing sections, resolve TODOs
* Add cspell entries
* Add missing steps to actually run the awx job
* Fix various lints
* Address review feedback
- Adds an explicit role
- Adds descriptions for created Teleport and k8s resources
- Adds missing filenames, save steps, and other implied steps
- Fixes various typos
- Adds links to the AWX guide from the Ansible guide and list of guides
* Fix typo in docs link
* Add more detail to the configmap description
* Tweak JWKS description
* Include additional references to Ansible Automation Platform
* Add documentation for `application-proxy` tbot service
* Update docs/pages/reference/machine-workload-identity/machine-id/configuration.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/reference/machine-workload-identity/machine-id/configuration.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/reference/machine-workload-identity/machine-id/configuration.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Slighlty reorganize so headings make sense
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Extend access_monitoring_rules API
Spec now includes a schedules field
* Validate schedules
* Update terraform provider
* Remove duplicate test case
* Comment shift fields
* Address feedback
- Remove timezone configuration
- Use schedule map instead of list
Using Teleport to enable authentication with a single sign-on provider
is a common use case. Tag pages with this use case so users can find
related pages when looking for SSO content.
The current RBAC demo guide includes instructions for SSHing into a
distroless Teleport container, which is not possible. Rework the
instructions to start two Ubuntu containers instead of two distroless
Teleport containers.
Closes#59493
Move sections at the top level of the Identity Governance section
related to syncing Teleport RBAC resources with an external system into
an Integrations section. This way, we can link to the section index when
we want to talk about Identity Governance integrations generally.
Using Teleport for session recording is a common use case. Tag pages
with this use case so users can find related pages when looking for
session recording content.
This resolves the expectation in the `remark-lint-page-structure` linter
that each page begin with at least one introductory paragraph. The
changes in #59542 attempted to ignore the linter, but since the `remark`
plugin for including partials preserves line numbers from the original
partial file in included AST nodes, the comment directive that ignores
the linter takes place after the linter violation. Placing the comment
before the violation causes the frontmatter to render incorrectly.
Merging gravitational/docs-website#393 removes the extraneous H1 heading
below the first paragraph.
Added missing 'kind: token' field and corrected 'allows' to 'allow' in the example join token YAML for GitHub bot. This improves accuracy and clarity for users following the getting started guide.
Sakshyam Shah