* Break up /database-access/guides/
Closes#17641
Organize the guides to enrolling databases in specific cloud providers
(or self-hosted databases) into separate subsections of the "Database
Actions" section, organized by cloud provider (or self-hosted).
We can later add general information to the index page of each
subsection about how Teleport database access works for each cloud
provider. The remaining guides in the "Guides" subsection have to do
with database-agnostic functionality of the Teleport Database Service.
This change also adds a redirect for each page it moves.
* Respond to greedy52 feedback
- In the "Database Access" intro page, move the self-hosted section
first in the list of links to database-specific guides so it's less
easy to miss.
- Change "AWS" to "Amazon" in product names.
* Fix linter issues
* Remove redirects added by the DB guide reorg
This prevents us from running into Vercel route limit issues, since the
number of redirects is large.
* Add Manifesto verbatim
* Add link to manifesto from introduction
* Add manifesto to navbar
* Reword slightly
* Further tidy up the copy
* Tidy up further reading description
* Use "increasingly" decreasingly
* Try to break up "distinct identity" and "liable to exfiltration"
* Update docs/pages/machine-id/introduction.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Further refine manifesto intro
* Avoid using term "powerful"
* cspell "automations"
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* wip Panther guide
* extra formatting and content updates
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* extra content updates, note machine id can't impersonate
* Update Panther Docs and Image
* Extra copy tweaks
* Update Var Fomatting
* switch to code to show formatting
* cluster vars isn't working for this code segment, change back
* Fix cspell lint
* switchout image
* Apply suggestions from code review
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add TPM to join method reference page
* Skeleton out the Linux/TPM guide
* Add yaml for join token
* Flesh out TPM joining guide
* Try var
* Add note on FIPS 140-2 compliance
* Add more vars
* ADd more background to how TPM joining works
* Clarify statement on most secure
* Add `tbot tpm identify` to cli reference
* Rename background to `how it works`
* Update docs/config.json
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/deployment/linux-tpm.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use Create A Bot template
* Expand TPM
* Reword tpm joining background
* Fix trailing ,
* Mention enterprise licensing
* cspell
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Document Azure CLI setup for AKS with Entra Workload ID
* add How it works section
* address review comments from Tener
* address comments from Paul
* try to fix lint and add version info
* Document how to import resources into Terraform
Closes#9720
Add a guide to importing Teleport resources into Terraform. While it is
mostly straightforward to add an `import` block, determining the ID to
use for each resource requires some planning, since the ID depends on
the resource type.
This change also edits the Terraform provider guide, since testing out
this guide was required to test out the resource import workflow:
- Minor style and readability tweaks.
- Remove the `-f` flag in `tctl create`: This way a user doesn't
accidentally override an existing `terraform` role
- Add a `tbot` data directory in an unprivileged path in the working
directory of the setup script. This way, we don't need to give
`teleport` ownership of the default Machine ID output directory.
- Fix identity file paths. These should point to a file called
`identity` in the `terraform-identity` directory.
- Edit the "Next steps" section to point to the resource import guide.
* Respond to Tener feedback
- Edit the "Terraform Provider" guide title to describe the purpose of
the guide more explicitly, distinguishing it from the new guide.
- Describe general rules for finding the ID of a resource, rather than
using a comprehensive table.
- Incorporate the import instructions into the setup guide. This way, we
don't need to clarify the relationship between two guides, which
wasn't entirely clear at the outset.
- Add a more explicit benefit statement for importing resources.
- Use the `-v` flag in `rm` commands
* Update docs/pages/management/dynamic-resources/terraform-provider.mdx
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Framework out workload-id docs
* Explain SPIFFE IDs/SVIDs
* Add pages to config
* Add very rough content for `tsh wworkloadid issue`
* Very rough start on "Teleport's Workload Identity"
* Explain Teleport offering and show example role
* Add `spiffe` to documented role spec
* Add advice on structuring SPIFFE IDs
* Add alternative to getting started guide
* Start notes on integrating SPIFFE with your workloads
* Add notes on using the `spiffe-svid` output
* Notes on using a Proxy to implement SPIFFE
* Add link to rust based sdk
* Add reference to `spiffe-inspect`
* Add prerequisites
* Finish rough drafting of workload id docs
* Link to Workload Identity from Machine ID introduction
* Update docs/pages/machine-id/workload-identity.mdx
Co-authored-by: Ben Arent <ben@goteleport.com>
* Adjust preview header
* Complete tsh guide
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* ADjust as per code review
* Explain workload identity a bit more
* Explain why Teleport Workload Identity is not Teleport Machine Identity
* Expand SPIFFE on first use
* Explain workload api endpoint
* Mention wildcard support in dns_sans
* Fix spellcheck
* Fix link to workload id guide from access guides
---------
Co-authored-by: Ben Arent <ben@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* document creating SSH servers via IAC
* add links and index page
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* address feedback + fix Var XML tags
* test tctl flow and fill tctl command outputs
* fix kubernetes and terraform documentation
* make docs linter happy
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* add db ca release versions to docs variables
* update split ca details snippet
* add patch release versions
* link to migration guide
* add all release versions to db ca migrations guide
* Update docs/pages/management/operations/db-ca-migrations.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
As these redirects are 2-3 years old, they are unlikely to impact users.
The exceptions are redirects added from the roots of docs sections like
`application-access` and `database-access` to the introduction pages of
these sections.
Used the following command to identify redirects from 2021:
```
git blame -L 1896,3190 -- docs/config.json | \
awk 'BEGIN{FS="[()]"} $2 ~ /2021/ && /source":/{print $3}'
```
* Reorganize two Access Controls sections
Partially addresses #37558
- Remove the Kubernetes Federation guide. This is more of a side note
about `tsh login` with trusted clusters, and gets very little traffic.
Consolidate it with the trusted cluster guide, which is more popular.
This allows us to remove the "Manage Access" subsection of "Kubernetes
Access", which only contains this and the RBAC how-to guide.
- Collapse the Kubernetes RBAC how-to guide into "Manage Access" to make
it more discoverable.
- Collapse the "Configuring Access" guide for databases into "RBAC". The
section contains a single guide, so this makes the content more
discoverable.
* Respond to tigrato feedback
- Add `tsh kube login` instructions to the trusted cluster guide
changes.
* Fix linter issues
- Remove the `team` scope from config.json.
- Edit the Edition comparison table to remove the "Team" column.
- Change the Teleport Team getting started guide to a Teleport
Enterprise Cloud getting started guide.
- Remove other Teleport Team mentions from the docs.
The changes in #38161 reorganized pages in the Server Access section of
the docs, but did not add redirects for these pages. This change adds
the missing redirects.
* Add a Discovery Service section
Closes#38741
Add a dedicated sidebar section for the Teleport Discovery Service.
Since the Discovery Service is a separate agent service from the SSH
Service, Kubernetes Service, etc., it makes sense to add a dedicated
section for this service. In the future, we can include configuration
guides, architecture guides, etc. in this section.
To create the new section, this change moves existing auto-discovery
guides from other sections of the docs.
* Respond to hugoShaka feedback
- Move the Kubernetes application discovery docs
- Edit the "Kubernetes Access" intro to include a link to Kubernetes
auto-discovery
* add nav slugs for DB CA migration and rotation guides
* add DB CA guides
* use --phase last in CA rotation guide example commands, so they're less tedious to
edit
* link to the database CA rotation guide for db and db_client CA rotation
* deprecate spec.ca_cert in db reference
* recommend parallel database ca rotation
* explain reconfig post rotation to fix db vuln
* update cspell to ignore -noout
* Update TAG version to 1.11.0
* Add a guide for deploying TAG using Helm
* Fix prose lint
* Add auto-generated reference for TAG Helm chart
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update TAG example role to v7
* Fix link to TAG Helm guide
* Pin TAG Helm chart version
Pins to the same version as TAG itself,
Helm chart and TAG are versioned in lockstep
* Call out the teleport Helm chart more explicitly
* Bump TAG version to 1.13.0
Expecting it to be released by the time these docs go live.
* Replace teleport-cluster parameters with Vars
* Elaborate trust of the TAG CA in Teleport
* Fix the marker style
* Fix the link to teleport-cluster reference
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Fix an incorrect sitemap link. The Teleport docs engine generates the
sitemap based on the contents of `docs/pages`. This directory tree
included a file called `docs/pages/server-access/guides/openssh.mdx`,
but the `config.json` for the docs content included a redirect from this
page to `docs/pages/server-access/guides/openssh/openssh.mdx`, meaning
that a page in the sitemap became inaccessible.
This change fixes the `/server-access` section of the docs to resolve
the sitemap issue. To do so, it creates the `server-access/openssh`
directory and moves OpenSSH guides into this directory. It updates
`config.json` and the Server Access menu page accordingly.
This change also adds a missing meta description to the self-hosted
Access Graph guide.
Closes#12660
We have moved all information for documentation contributors to the
README of `github.com/gravitational/docs`. This change removes this
information from the Teleport docs site.
The advantages of this approach are that:
- All information for docs contributors is in one place
- We can free up a navigation sidebar entry, since we no longer need the
"Contribute" link.
* Add a guide for setting up Access Graph on-prem
* Update docs/pages/access-graph/getting-started-on-prem.mdx
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Update minimum required Teleport version
* Address review suggestions
* Note support for Amazon RDS
* Add a note about Teleport Policy
* Move license requirement to "Prerequisites"
* Bump TAG version in docs
* Address review comments
* Update docs/pages/access-graph/getting-started-on-prem.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update Access Graph menu item image
* Update wording in Teleport Team notice
* Expand on requirements for the TLS certificate
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Move access-graph pages under access-controls
* Get rid of extraneous tags
* Add a short introduction to the guide
* Elaborate where the TAG config should live
* nit
* Rename the TAG self-hosted guide
* Fix image paths after access-graph renaming
---------
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add an overview of the Teleport documentation
Closes#34038
Help visitors to the Teleport documentation find their way through the
docs site by including a description of each docs page in an overview
guide.
This change is based on adapting the former Teleport index page (prior
to #27703).
* Minor grammar and language tweaks
* saml attribute mapping reference
* formatting
* rename test_attribute_mapping to test-attribute-mapping
* - copy edits
- update add method to show set().add() and set(values) syntax
- update strings.split() syntax
* address review comments:
- move prerequisite up
- remove description from predicate evaluation context table
- copy edits
* - add attribute mapping reference to idp.mdx (root page)
- add a line explaining the context of the page
- move attribute mapping context inside Predicate expressions heading
- remove tctl reference
* revert previous commit on saml-attribute-mapping.mdx
* - move concept to top of the page
- add tctl reference back
* single identation for sub nesting
* single indent for attribute mapping name format
* update saml reference copy on idp.mdx (root page)
We removed this feature in v15, so remove the guide from the docs and
add a redirect. v14 users can refer to v14 of the docs, which includes
the guide along with a deprecation notice.
Marco Dinis