* Break up /database-access/guides/
Closes#17641
Organize the guides to enrolling databases in specific cloud providers
(or self-hosted databases) into separate subsections of the "Database
Actions" section, organized by cloud provider (or self-hosted).
We can later add general information to the index page of each
subsection about how Teleport database access works for each cloud
provider. The remaining guides in the "Guides" subsection have to do
with database-agnostic functionality of the Teleport Database Service.
This change also adds a redirect for each page it moves.
* Respond to greedy52 feedback
- In the "Database Access" intro page, move the self-hosted section
first in the list of links to database-specific guides so it's less
easy to miss.
- Change "AWS" to "Amazon" in product names.
* Fix linter issues
* Remove redirects added by the DB guide reorg
This prevents us from running into Vercel route limit issues, since the
number of redirects is large.
Closes#41443
The VarList component has failed to render for a long time (at least six
months). Since the component has not received widespread adoption in
docs pages, remove instances of the component in preparation for
removing the component itself from the docs engine.
* Add Manifesto verbatim
* Add link to manifesto from introduction
* Add manifesto to navbar
* Reword slightly
* Further tidy up the copy
* Tidy up further reading description
* Use "increasingly" decreasingly
* Try to break up "distinct identity" and "liable to exfiltration"
* Update docs/pages/machine-id/introduction.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Further refine manifesto intro
* Avoid using term "powerful"
* cspell "automations"
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Log UDS sourced peer info
* Add logging of peer address when non-unix
* Properly group logging attributes when svid is issued
* Add config structs for unix workload attestation and tests
* Add test for entire bot config
* Return `PermissionDenied` when no SVIDs available as per SPIFFE Workload API 5.2.1
* Filter down SVIDs based on workload attestation
* Add improved logging
* Add basic unit test
* Add e2e test that uses workload attestation
* Document workload attestation features
Some third-party security tools override the default Microsoft smart
card driver with custom software. These custom drivers can prevent
Windows from reading certificates from Teleport's virtual smart card,
which prevents the automatic logon process from completing.
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Add own-CA instructions to self-hosted DB guides
Closes#14728
In guides where we show how to configure Teleport to protect a
self-hosted database that uses mTLS to communicate with the Database
Service, show how to configure the Database Service to trust a custom
CA.
This includes the following self-hosted database guides:
- Postgres
- Vitess
- MySQL
- Elasticsearch
- ClickHouse
- Standalone Redis
- Standalone MongoDB
- Cassandra/Scylla
- Oracle
This change does not touch guides that:
- Already include instructions to configure the Database Service to
trust a custom CA via the `ca_cert_file` config field, e.g., the
CockroachDB and Redis cluster guides.
- Use a different authentication mechanism, e.g., the SQL Server PKINIT
guide.
* Respond to feedback
- Change `db-client` to `db_client` in commands beside `tctl auth
export`. (greedy52)
- Use consistent Proxy Service example addresses in the Clickhouse
guide. (Tener)
- Fix wording around the function of a CA. (GavinFrazar)
- Clarify remote `tctl` permissions in partials. (GavinFrazar)
- Clarify the need for `Db` impersonation privileges. (GavinFrazar)
* Update docs/pages/includes/database-access/self-hosted-introduction.mdx
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Respond to greedy52 feedback
- Edit `tctl-auth-sign-3-files.mdx` to instruct the user to append the
database client CA to your database's existing cert file.
- Use Tabs for tctl-auth-sign-3-files.mdx
---------
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Update device trust support notice
* Update prerequisites
* Update troubleshooting
* Remove Web UI warning
* Update the App Access section
* Add the Desktop Access section
* Mention Teleport v16 on App Access content
* Mention that the services do the enforcement
This PR allows users to set `clusterDomain` to match Kubernetes Cluster
domain address when running clusters with non default cluster domains.
Fixes#41165
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Also removes the outdated mention of locking accounts after failed
password reset attempts. This functionality was removed in #35325
but the docs were not updated.
Closes#41135
* wip Panther guide
* extra formatting and content updates
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* extra content updates, note machine id can't impersonate
* Update Panther Docs and Image
* Extra copy tweaks
* Update Var Fomatting
* switch to code to show formatting
* cluster vars isn't working for this code segment, change back
* Fix cspell lint
* switchout image
* Apply suggestions from code review
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* [docs] Update DB access AWS IAM reference page
* add other aws databases
* reword and fix a few spots
* remove please and add the for service
* address review coments
* fix spelling
* fix link
* Add TPM to join method reference page
* Skeleton out the Linux/TPM guide
* Add yaml for join token
* Flesh out TPM joining guide
* Try var
* Add note on FIPS 140-2 compliance
* Add more vars
* ADd more background to how TPM joining works
* Clarify statement on most secure
* Add `tbot tpm identify` to cli reference
* Rename background to `how it works`
* Update docs/config.json
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/deployment/linux-tpm.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use Create A Bot template
* Expand TPM
* Reword tpm joining background
* Fix trailing ,
* Mention enterprise licensing
* cspell
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add `database-tunnel` service to Machine ID reference
* Update docs/pages/machine-id/reference/configuration.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Historically proxy templates have only supported an exact hostname
match via the `Host` field defined. This limits some of the benefits
of using proxy templates and forces users to do a bunch of extra
work in their ssh config. For example, if a user today wanted to
leverage proxy templates to connect to a host via a label, predicate
expression, or fuzzy match, they would be required to use tsh ls,
find the matching UUID or hostname and provide that to tsh for
evaluation with the template expression.
SSH Config:
```
Match Host *.example.com
ProxyCommand tsh proxy ssh %r@$(tsh ls --search=$(echo %h | cut -d. -f1) -f json | jq -r '.[0].metadata.name'):%p
```
The above requires multiple subshells, a connection to the Auth
server, and jq to be installed on the client machine in order to
work.
To reduce the amount of effort required to connect to a resource
proxy templates have been updated with a `Search` and a `Query`
field to support fuzzy search and predicate expressions much like
`tsh ls --search` and `tsh ls --query`. The order of operations
for matching the target host is: 1) Host, 2) Predicate Expression,
3) Query.
In addition to the proxy template changes, tsh proxy ssh
has also been updated to allow resolving the target via
searching or querying -- though ONLY via proxy templates.
There are no additional `--query` or `--search` flags added
to tsh proxy ssh for the time being. This is mostly for CLI UX
reasons since neither tsh ssh or tsh proxy ssh support those
flags today, and only allow filtering by label via supplying
key value pairs in the hostname (tsh ssh alice@foo=bar,env=dev).
tsh proxy ssh is however still limited to connecting to a single
host at a time. If there are no matches, or multiple matches found
as a result of target resolution, then an error is returned.
With the new functionality, the above example can be simplified to
the following.
SSH Config:
```
Match Host *.example.com
ProxyCommand tsh proxy ssh %r@%h
```
Proxy Template:
```
- template: '^(.*).example.com:\d+$'
search: "$1"
```
This shifts the resposibility of host resolution from the caller
to tsh. It allows resolution to happen in the same process that
will initiate the connection, reducing a dial to the cluster, and
eliminating the need for any subshells, or extra tools outside
of tsh to be present.
* Configurable podSecurityContext for auth and proxy deployments
* Lint podSecurityContext for Teleport Cluster chart
* Test podSecurityContext for auth and proxy deployments
* PodSecurityContext schema for Teleport Cluster chart
* Document podSecurityContext for Teleport Cluster chart
---------
Co-authored-by: Niek den Breeje <n.denbreeje@guardian360.nl>
* Document Azure CLI setup for AKS with Entra Workload ID
* add How it works section
* address review comments from Tener
* address comments from Paul
* try to fix lint and add version info
Marco Dinis