* Break up /database-access/guides/
Closes#17641
Organize the guides to enrolling databases in specific cloud providers
(or self-hosted databases) into separate subsections of the "Database
Actions" section, organized by cloud provider (or self-hosted).
We can later add general information to the index page of each
subsection about how Teleport database access works for each cloud
provider. The remaining guides in the "Guides" subsection have to do
with database-agnostic functionality of the Teleport Database Service.
This change also adds a redirect for each page it moves.
* Respond to greedy52 feedback
- In the "Database Access" intro page, move the self-hosted section
first in the list of links to database-specific guides so it's less
easy to miss.
- Change "AWS" to "Amazon" in product names.
* Fix linter issues
* Remove redirects added by the DB guide reorg
This prevents us from running into Vercel route limit issues, since the
number of redirects is large.
* Document Azure CLI setup for AKS with Entra Workload ID
* add How it works section
* address review comments from Tener
* address comments from Paul
* try to fix lint and add version info
* Refresh the AWS app access guide
Issues closed:
--------------
Add a statement of benefits, a brief architecture overview, more
troubleshooting information, and a summary of IAM resources created in
this guide.
Closes#10853
Add troubleshooting re: trust relationships and
checking logs.
Closes#17880
Add more explicit trust relationship guidance and uses
CLI examples instead of console screenshots.
Closes#34167
Add more context re: the trust relationship
instructions.
Closes#11797
Add instructions that a user can follow to deploy the
Application Service on EKS.
Closes#24373
Other changes to make the guide easier to follow:
-------------------------------------------------
- Only show one IAM role. Remove the `ExamplePowerUser` role for
simplicity.
- Use the `aws` CLI for creating IAM resources. This is faster to follow
than the current approach, takes up less page real estate, and doesn't
require screenshots. Using the CLI also makes the trust relationship
instructions more explicit.
- Move external links to a "Further reading" section so readers can get
through the guide more quickly.
- Remove the video, since it's long out of date.
- Reduce the number of steps: Convert steps into H3s in order to make it
easier to form a mental model of the guide and make the step count
less intimidating.
- Add EC2 instance profile instructions.
- Add a quick boto3 python example for `tsh proxy aws`
* Respond to greedy52 feedback
- Say "EKS" instead of just "Kubernetes" in the prerequisites.
- Edit the trust policy for the `ExampleReadOnlyAccess` role in the
cross-account use case to include an external ID and require a
specific role for the principal.
* Respond to kimlisa feedback
- Fix unclear subsection intro sentence.
- Fix a potentially confusing reference to Step 1.
- Fix an unclear use of "configuration".
- Clarify a heading.
- Minor clarity/accuracy improvements.
- Use a Var component for the Proxy Service address in the Linux server
config file snippet.
* Add a Discovery Service section
Closes#38741
Add a dedicated sidebar section for the Teleport Discovery Service.
Since the Discovery Service is a separate agent service from the SSH
Service, Kubernetes Service, etc., it makes sense to add a dedicated
section for this service. In the future, we can include configuration
guides, architecture guides, etc. in this section.
To create the new section, this change moves existing auto-discovery
guides from other sections of the docs.
* Respond to hugoShaka feedback
- Move the Kubernetes application discovery docs
- Edit the "Kubernetes Access" intro to include a link to Kubernetes
auto-discovery
Closes#35337
The diagram in the "Getting Started" page of the "Application Access"
section has been misleading to users, as it does not indicate which
Teleport components are involved in application routing.
There is now a diagram in the Introduction page of the section that is
clearer in terms of which components are involved in Teleport
application access and how they interact. This change removes the
diagram in the "Getting Started" page.
Note that the Introduction page diagram could use some improvement--it's
pretty overwhelming--but since users who put in the effort can still use
it to identify interactions between Teleport components, we can clarify
the diagram in a future change rather than in this one.
This PR extends existing supported annotations to be able to import
applications from Kubernetes that require disabling TLS verification.
It also adds `teleport.dev/ignore` annotation when users want to exclude
single Kubernetes services from being imported when they share the same
labels as other services that must be imported.
Fixes#36328Fixes#36177
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Closes#19190
Ensure that all "\<Resource\> Access" sections of the docs include an
architecture diagram by adding diagrams to the "Server Access" and
"Application Access" sections.
The intro page of the Application Access section currently includes a
demo video. There is no elegant way to include both the demo video and
the architecture diagram. This change removes the demo video since it is
out of date.
Closes#22378
Include an example of using template variables with the `aws_role_arns`
field in the AWS Console guide. Also link to a more appropriate guide,
which has specific information about this field.
Closes#10136
- Describe how a role can allow a user to manage the `app` resource.
- Subdivide the dynamic app registration page to account for the new
text.
- Edit the intro section to pave the way for the permissions section by
introducing the `app` resource and, briefly, how it works
architecturally.
* Update diagrams in the docs
Closes#31324
We introduced a new Lucidchart library for adding diagrams to docs
pages. This change:
- Replaces all MermaidJS diagrams with ones that use the new library,
which enables us to phase out the `remark-mermaid` plugin.
- Replaces some other diagrams with the new library.
* Minor tweaks to diagram images
Responds to strongeron feedback
The syntax [unfortunately] differs when apps are defined in
teleport.yaml as compared to when they are defined as YAML
resources and applied with tctl.
* Remove "Preview" designation
Teleport is moving away from the concept of a preview feature. This
change reflects this move on the docs site.
* Respond to zmb3 feedback
Restore the "Preview" note to the AI Assist page.
* Explain template variables wherever they appear
Closes#13377
Wherever a page in the docs mentions the `internal` or `external`
template variables as they apply to Teleport roles, link to the Teleport
Access Controls Reference
(docs/pages/access-controls/reference.mdx#roles).
A separate change (#32696) will expand the Access Controls Reference to
include more information on the `external` and `internal` template
variables.
* Respond to zmb3 feedback
Refer to `internal` and `external` as traits instead of template
variables.
* Apply suggestions from code review
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Linter fixes
---------
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Add hosted Access Request plugin docs
See #29979
For the most part, the documentation for the Teleport Access Request
plugins assumes that a user is self-hosting their plugins, and contains
information for installing and configuring the plugin that is not
relevant to a user of hosted plugins.
This change edits the menu page of the Access Request plugin subsection
of the docs to add instructions for enrolling hosted Access Request
plugins. It also adds a note to the top of each guide for an Access
Request plugin with a hosted counterpart that a user can enable the
hosted version of that plugin. This anticipates a separate change to add
more detailed instructions to the hosted Access Request plugin
enrollment workflow within the Web UI.
* Update docs/pages/application-access/okta/guide.mdx
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
---------
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
These are strings, not objects, so they must be quoted.
Also removed the <Var> component here since it makes it
harder to spot the trailing slash and breaks YAML syntax
highlighting.
Closes#32460
* Change Open source and OSS to Teleport Community Edition
* Change open-source to Teleport Community Edition
* Role access requests in the nav and title
I realised when I sent @lsgunn-teleport the information on how to add the `Origin` and `Host` headers that I didn't make it obvious that they should be provided as a list.
* Add main documentation for Kubernetes Apps Discovery
* Improve wording.
* Add internal link for annotation
* Improve wording.
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Remove unneeded symbol
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Improve wording.
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Make example cluster names consistent
* Restructure the Kubernetes app discovery guide (#31606)
- Move the docs to the Application Access section, since this material
has to do with proxying applications via the Application Service.
- Split up the guide into separate guides for different documentation
purposes: a how-to guide, configuration reference, and architecture
guide.
- Fix linter/spelling issues
* Add not about running agent inside the Kuberentes cluster
* Add instruction how to enabled kube app discovery on existing installation
* Add example of configuration of teleport-kube-agent Helm chart
* convert tip to tabs
* fix wrong ref
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Rough draft of troubleshooting for apps
* Add Kubernetes fix and untrusted certificate
* Fix typo in untrusted certs topic
* Change app service to application configuration to make the linter happy
* Add troubleshooting to nav
* Add troubleshooting to nav
* Add docs to Kubernetes per-Resource RBAC
This PR adds documentation for the Kubernetes per-Resource RBAC and
supported verbs introduced in Teleport 14.
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* initial review
* fix lint
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* fix bad reference
* Restructure the Resource Requests guide (#31637)
Move the subsection on requesting access to Kubernetes resources to an
H3. This way, we can avoid an unslightly H6 heading. Also, since this
section relates to requesting access, not restricting access, it's more
discoverable in a separate H3.
---------
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Fixes#27161
Mention the Okta integration to ensure that the "Application Access"
section introduction mentions all major categories of application access
features.
* Edit the app access DynamoDB guide
Closes#21774
Add an explicit recommendation to use the Database Service to proxy
DynamoDB. There is already language in the guide to compare the App
Service and Database Service approaches, so this change moves this text
into an Admonition and includes the recommendation there.
* Respond to zmb3 feedback
* Replace multi-line ScopedBlocks with Tabs
Contributes to #30268
The documentation scope switcher tends to confuse users, and the
ScopedBlock component hides docs content based on the scope switcher. To
help remove ScopedBlocks from the docs site, this change replaces
multi-line ScopedBlocks with Tabs components if they include variations
for different scopes.
While most multi-line ScopedBlocks function like Tabs, there are a few
edge cases, which this change addresses individually.
Note that this change does not intend to remove all ScopedBlocks that
are placed inline within a paragraph. That will be the goal of a
separate change.
* Remove more ScopedBlocks (#30623)
This builds on the work done in #30616 and contributes to #30616.
* updated getting started video
* updating video banner with new video
* updated getting started video with new
---------
Co-authored-by: Steven Martin <steven@goteleport.com>
Fixes#23449
Ensure that all guides that include instructions for installing the
`teleport-kube-agent` chart also show how to check that the Teleport
agent pods are up and healthy.
* Some language updates to learn the ropes of working in these files
* First pass at simplifying this page, removing redundant steps and making editorial suggestions for the content
FIX
* Modified according to review comments plus some refinements
FIX
* Fix merge conflicts in my file.
* Fixing conflicts
* Add link for Teleport Team sign up
* Changes from Paul's review plus some fine-tuning
* simplify graphic usage
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Fix typos, replace two graphics with one
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Paul Gottschling