* Break up /database-access/guides/
Closes#17641
Organize the guides to enrolling databases in specific cloud providers
(or self-hosted databases) into separate subsections of the "Database
Actions" section, organized by cloud provider (or self-hosted).
We can later add general information to the index page of each
subsection about how Teleport database access works for each cloud
provider. The remaining guides in the "Guides" subsection have to do
with database-agnostic functionality of the Teleport Database Service.
This change also adds a redirect for each page it moves.
* Respond to greedy52 feedback
- In the "Database Access" intro page, move the self-hosted section
first in the list of links to database-specific guides so it's less
easy to miss.
- Change "AWS" to "Amazon" in product names.
* Fix linter issues
* Remove redirects added by the DB guide reorg
This prevents us from running into Vercel route limit issues, since the
number of redirects is large.
* Add own-CA instructions to self-hosted DB guides
Closes#14728
In guides where we show how to configure Teleport to protect a
self-hosted database that uses mTLS to communicate with the Database
Service, show how to configure the Database Service to trust a custom
CA.
This includes the following self-hosted database guides:
- Postgres
- Vitess
- MySQL
- Elasticsearch
- ClickHouse
- Standalone Redis
- Standalone MongoDB
- Cassandra/Scylla
- Oracle
This change does not touch guides that:
- Already include instructions to configure the Database Service to
trust a custom CA via the `ca_cert_file` config field, e.g., the
CockroachDB and Redis cluster guides.
- Use a different authentication mechanism, e.g., the SQL Server PKINIT
guide.
* Respond to feedback
- Change `db-client` to `db_client` in commands beside `tctl auth
export`. (greedy52)
- Use consistent Proxy Service example addresses in the Clickhouse
guide. (Tener)
- Fix wording around the function of a CA. (GavinFrazar)
- Clarify remote `tctl` permissions in partials. (GavinFrazar)
- Clarify the need for `Db` impersonation privileges. (GavinFrazar)
* Update docs/pages/includes/database-access/self-hosted-introduction.mdx
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Respond to greedy52 feedback
- Edit `tctl-auth-sign-3-files.mdx` to instruct the user to append the
database client CA to your database's existing cert file.
- Use Tabs for tctl-auth-sign-3-files.mdx
---------
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* [docs] Update DB access AWS IAM reference page
* add other aws databases
* reword and fix a few spots
* remove please and add the for service
* address review coments
* fix spelling
* fix link
* Add architectural information to database guides
Closes#21540
Rather than attempt to describe the entirety of the database access
architecture in the `/docs/database-access/architecture/` guide, this
change:
- Edits the architecture guide to clarify that authentication between
the Teleport Database Service and each proxied database depends on the
database.
- Adds a "How it works" H2 before the "Prerequisites" H2 of each how-to
guide for accessing a specific database, describing the architecture
of the setup shown in the guide.
* Respond to greedy52 feedback
- Correct the DynamoDB and OpenSearch architecture descriptions.
- Correct the AWS Redis architecture description by moving a description
from later in the page. Also adds Redis ACL to the prerequisites.
- Edit the Azure Cache for Redis and Azure MySQL and PostgreSQL guides
to say "Microsoft Entra ID" in the architecture section. This change
does not attempt to correct "Azure AD" elsewhere in the guides, as
this entails fixing UI instructions that are outside the scope of the
PR.
* Remove auto-discovery from specific DB guides
Closes#22942
Help users enroll specific databases with Teleport while directing them
auto-discovery instructions if they want to go that route.
- Revert #30913 for guides to enrolling specific databases. For guides
that always included auto-discovery instructions, add instructions to
enroll databases at specific URLs.
- Add a note in the introduction sections of AWS guides that it is
possible to enroll AWS databases with auto-discovery, linking to the
relevant guide.
* Respond to greedy52 feedback
- Remove auto-discovery notes where they are incorrect.
- Remove unneeded `id` flags.
- Use `teleport db configure create` for Redshift Serverless, removing
unneeded config fields. Also add the `aws-bootstrap.mdx` partial to
the Redshift Serverless guide, making it more consistent with other
guides that include `teleport db configure bootstrap` instructions.
- Minor spelling/grammar tweaks.
- Fix example description outputs.
- Use URI/protocol flags in `rds-proxy.mdx` instructions.
- Restore `opensearch` to `database-config.yaml`.
* Respond to greedy52 feedback
- Add the `--name` parameter to `db configure create`
- Edit `tsh db ls` output in the RDS guide
* Fix linter issues
Closes#38933
Simplify the instructions in the `install-linux.mdx` partial by
including instructions for the one-line installation script instead of
having the user choose the Teleport edition from a dropdown menu, then
choose a package manager. The one-line installation script chooses a
package manager automatically.
Since we only include `install-linux.mdx` in guides to installing
Teleport on agent nodes, instruct the user to get the version of either
the automatic updater (if automatic updates are enabled) or the Teleport
cluster.
This approach has the advantage of not using tabs, so it creates less
noise when authors include this partial in a `Tabs` component.
Also include a link to our installation guide at the end of the partial
for readers who want more information on our package repos.
* Reorganize two Access Controls sections
Partially addresses #37558
- Remove the Kubernetes Federation guide. This is more of a side note
about `tsh login` with trusted clusters, and gets very little traffic.
Consolidate it with the trusted cluster guide, which is more popular.
This allows us to remove the "Manage Access" subsection of "Kubernetes
Access", which only contains this and the RBAC how-to guide.
- Collapse the Kubernetes RBAC how-to guide into "Manage Access" to make
it more discoverable.
- Collapse the "Configuring Access" guide for databases into "RBAC". The
section contains a single guide, so this makes the content more
discoverable.
* Respond to tigrato feedback
- Add `tsh kube login` instructions to the trusted cluster guide
changes.
* Fix linter issues
- Remove the `team` scope from config.json.
- Edit the Edition comparison table to remove the "Team" column.
- Change the Teleport Team getting started guide to a Teleport
Enterprise Cloud getting started guide.
- Remove other Teleport Team mentions from the docs.
* Add a Discovery Service section
Closes#38741
Add a dedicated sidebar section for the Teleport Discovery Service.
Since the Discovery Service is a separate agent service from the SSH
Service, Kubernetes Service, etc., it makes sense to add a dedicated
section for this service. In the future, we can include configuration
guides, architecture guides, etc. in this section.
To create the new section, this change moves existing auto-discovery
guides from other sections of the docs.
* Respond to hugoShaka feedback
- Move the Kubernetes application discovery docs
- Edit the "Kubernetes Access" intro to include a link to Kubernetes
auto-discovery
* add nav slugs for DB CA migration and rotation guides
* add DB CA guides
* use --phase last in CA rotation guide example commands, so they're less tedious to
edit
* link to the database CA rotation guide for db and db_client CA rotation
* deprecate spec.ca_cert in db reference
* recommend parallel database ca rotation
* explain reconfig post rotation to fix db vuln
* update cspell to ignore -noout
* fix indentation of note in mongo guide
* note redis version limits next to version prereq
* extract custom db tls CA snippet from MongoDB
* update pre-reqs for self-hosted cluster databases
* expand tls config setup in CockroachDB guide
* remove redis cluster tls-cluster no config tab
This config still requires a custom CA, so it's pointless
and less secure.
It also doesn't work with the rest of the guide steps currently.
* use code block instead of sh in redis cluster doc
* dont explain tctl auth sign setup when unused
* fix redis-cluster code block
* describe teleport trust setup last
* clarify cluster creation certs
* use more descriptive tab labels for cockroachdb
* only mention lack of support for RESP3
redis 7.0 is supported with RESP2, no need to call it out.
* [docs] IAM-auth-as-IAM-roles for Redshift
* new section for iam role auth
* clarify two methods
* review comments
* fix spelling, thanks to docs lint!
* Update docs version mentions to reflect v15
- Remove mentions of pre-v12 versions. We mention the version prior to
the earliest supported version in case some users still need to
upgrade.
This includes removing the Helm migration guide from v11 to v12. The
idea is that Teleport users should be on v12 already (the earliest
supported version before we released v15), so this guide should not be
needed.
- Updated the supported version table in the FAQ.
* Respond to feedback
Restore the v12 migration guide with a note to remove it in v16.
* Update diagrams in the docs
Closes#31324
We introduced a new Lucidchart library for adding diagrams to docs
pages. This change:
- Replaces all MermaidJS diagrams with ones that use the new library,
which enables us to phase out the `remark-mermaid` plugin.
- Replaces some other diagrams with the new library.
* Minor tweaks to diagram images
Responds to strongeron feedback
Fixes#29913
The `Details` box is the wrong component for a version warning, since
this box is meant for users to expand and collapse, and there is no
benefit of expanding and collapsing a version warning. Depending on the
guide, this change either:
- Integrates the version warning into the Prerequisites section of a
how-to guide
- Makes the version warning regular text within the introductory section
* Remove "Preview" designation
Teleport is moving away from the concept of a preview feature. This
change reflects this move on the docs site.
* Respond to zmb3 feedback
Restore the "Preview" note to the AI Assist page.
* Explain template variables wherever they appear
Closes#13377
Wherever a page in the docs mentions the `internal` or `external`
template variables as they apply to Teleport roles, link to the Teleport
Access Controls Reference
(docs/pages/access-controls/reference.mdx#roles).
A separate change (#32696) will expand the Access Controls Reference to
include more information on the `external` and `internal` template
variables.
* Respond to zmb3 feedback
Refer to `internal` and `external` as traits instead of template
variables.
* Apply suggestions from code review
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Linter fixes
---------
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Update Oracle DB docs and messaging
update the docs and `tctl auth sign` instructions to call out the need to have the file permissions set to the oracle user
* Update oracle-self-hosted.mdx
* Update oracle-self-hosted.mdx
* Update docs/pages/database-access/guides/oracle-self-hosted.mdx
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Update tool/tctl/common/auth_command.go
Co-authored-by: Marek Smoliński <marek@goteleport.com>
* Update auth_command.go
---------
Co-authored-by: Marek Smoliński <marek@goteleport.com>
Gavin Frazar