* Break up /database-access/guides/
Closes#17641
Organize the guides to enrolling databases in specific cloud providers
(or self-hosted databases) into separate subsections of the "Database
Actions" section, organized by cloud provider (or self-hosted).
We can later add general information to the index page of each
subsection about how Teleport database access works for each cloud
provider. The remaining guides in the "Guides" subsection have to do
with database-agnostic functionality of the Teleport Database Service.
This change also adds a redirect for each page it moves.
* Respond to greedy52 feedback
- In the "Database Access" intro page, move the self-hosted section
first in the list of links to database-specific guides so it's less
easy to miss.
- Change "AWS" to "Amazon" in product names.
* Fix linter issues
* Remove redirects added by the DB guide reorg
This prevents us from running into Vercel route limit issues, since the
number of redirects is large.
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
* Add own-CA instructions to self-hosted DB guides
Closes#14728
In guides where we show how to configure Teleport to protect a
self-hosted database that uses mTLS to communicate with the Database
Service, show how to configure the Database Service to trust a custom
CA.
This includes the following self-hosted database guides:
- Postgres
- Vitess
- MySQL
- Elasticsearch
- ClickHouse
- Standalone Redis
- Standalone MongoDB
- Cassandra/Scylla
- Oracle
This change does not touch guides that:
- Already include instructions to configure the Database Service to
trust a custom CA via the `ca_cert_file` config field, e.g., the
CockroachDB and Redis cluster guides.
- Use a different authentication mechanism, e.g., the SQL Server PKINIT
guide.
* Respond to feedback
- Change `db-client` to `db_client` in commands beside `tctl auth
export`. (greedy52)
- Use consistent Proxy Service example addresses in the Clickhouse
guide. (Tener)
- Fix wording around the function of a CA. (GavinFrazar)
- Clarify remote `tctl` permissions in partials. (GavinFrazar)
- Clarify the need for `Db` impersonation privileges. (GavinFrazar)
* Update docs/pages/includes/database-access/self-hosted-introduction.mdx
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Respond to greedy52 feedback
- Edit `tctl-auth-sign-3-files.mdx` to instruct the user to append the
database client CA to your database's existing cert file.
- Use Tabs for tctl-auth-sign-3-files.mdx
---------
Co-authored-by: Gavin Frazar <gavin.frazar@goteleport.com>
* Update device trust support notice
* Update prerequisites
* Update troubleshooting
* Remove Web UI warning
* Update the App Access section
* Add the Desktop Access section
* Mention Teleport v16 on App Access content
* Mention that the services do the enforcement
* [docs] Update DB access AWS IAM reference page
* add other aws databases
* reword and fix a few spots
* remove please and add the for service
* address review coments
* fix spelling
* fix link
* Add TPM to join method reference page
* Skeleton out the Linux/TPM guide
* Add yaml for join token
* Flesh out TPM joining guide
* Try var
* Add note on FIPS 140-2 compliance
* Add more vars
* ADd more background to how TPM joining works
* Clarify statement on most secure
* Add `tbot tpm identify` to cli reference
* Rename background to `how it works`
* Update docs/config.json
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/deployment/linux-tpm.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use Create A Bot template
* Expand TPM
* Reword tpm joining background
* Fix trailing ,
* Mention enterprise licensing
* cspell
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Document Azure CLI setup for AKS with Entra Workload ID
* add How it works section
* address review comments from Tener
* address comments from Paul
* try to fix lint and add version info
* Add architectural information to database guides
Closes#21540
Rather than attempt to describe the entirety of the database access
architecture in the `/docs/database-access/architecture/` guide, this
change:
- Edits the architecture guide to clarify that authentication between
the Teleport Database Service and each proxied database depends on the
database.
- Adds a "How it works" H2 before the "Prerequisites" H2 of each how-to
guide for accessing a specific database, describing the architecture
of the setup shown in the guide.
* Respond to greedy52 feedback
- Correct the DynamoDB and OpenSearch architecture descriptions.
- Correct the AWS Redis architecture description by moving a description
from later in the page. Also adds Redis ACL to the prerequisites.
- Edit the Azure Cache for Redis and Azure MySQL and PostgreSQL guides
to say "Microsoft Entra ID" in the architecture section. This change
does not attempt to correct "Azure AD" elsewhere in the guides, as
this entails fixing UI instructions that are outside the scope of the
PR.
Closes#40026
Reduce the space that our standard prerequisites partials take within
docs pages by:
- Using prose instead of tabs to suggest different possibilities for
getting started.
- Removing example commands to find the `tctl` and `tsh` versions. The
intended audience of the Teleport docs should be familiar enough with CLI
tools to infer that there is a `version` subcommand, as this is a
convention across CLI tools.
This change also removes `user-client-prereqs.mdx`, since it is no
longer used, and replaces `no-oss-prereq-tabs.mdx` with
`commercial-prereqs-tabs.mdx` (the two address the same use cases).
* Remove auto-discovery from specific DB guides
Closes#22942
Help users enroll specific databases with Teleport while directing them
auto-discovery instructions if they want to go that route.
- Revert #30913 for guides to enrolling specific databases. For guides
that always included auto-discovery instructions, add instructions to
enroll databases at specific URLs.
- Add a note in the introduction sections of AWS guides that it is
possible to enroll AWS databases with auto-discovery, linking to the
relevant guide.
* Respond to greedy52 feedback
- Remove auto-discovery notes where they are incorrect.
- Remove unneeded `id` flags.
- Use `teleport db configure create` for Redshift Serverless, removing
unneeded config fields. Also add the `aws-bootstrap.mdx` partial to
the Redshift Serverless guide, making it more consistent with other
guides that include `teleport db configure bootstrap` instructions.
- Minor spelling/grammar tweaks.
- Fix example description outputs.
- Use URI/protocol flags in `rds-proxy.mdx` instructions.
- Restore `opensearch` to `database-config.yaml`.
* Respond to greedy52 feedback
- Add the `--name` parameter to `db configure create`
- Edit `tsh db ls` output in the RDS guide
* Fix linter issues
* Framework out workload-id docs
* Explain SPIFFE IDs/SVIDs
* Add pages to config
* Add very rough content for `tsh wworkloadid issue`
* Very rough start on "Teleport's Workload Identity"
* Explain Teleport offering and show example role
* Add `spiffe` to documented role spec
* Add advice on structuring SPIFFE IDs
* Add alternative to getting started guide
* Start notes on integrating SPIFFE with your workloads
* Add notes on using the `spiffe-svid` output
* Notes on using a Proxy to implement SPIFFE
* Add link to rust based sdk
* Add reference to `spiffe-inspect`
* Add prerequisites
* Finish rough drafting of workload id docs
* Link to Workload Identity from Machine ID introduction
* Update docs/pages/machine-id/workload-identity.mdx
Co-authored-by: Ben Arent <ben@goteleport.com>
* Adjust preview header
* Complete tsh guide
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* ADjust as per code review
* Explain workload identity a bit more
* Explain why Teleport Workload Identity is not Teleport Machine Identity
* Expand SPIFFE on first use
* Explain workload api endpoint
* Mention wildcard support in dns_sans
* Fix spellcheck
* Fix link to workload id guide from access guides
---------
Co-authored-by: Ben Arent <ben@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Closes#38933
Simplify the instructions in the `install-linux.mdx` partial by
including instructions for the one-line installation script instead of
having the user choose the Teleport edition from a dropdown menu, then
choose a package manager. The one-line installation script chooses a
package manager automatically.
Since we only include `install-linux.mdx` in guides to installing
Teleport on agent nodes, instruct the user to get the version of either
the automatic updater (if automatic updates are enabled) or the Teleport
cluster.
This approach has the advantage of not using tabs, so it creates less
noise when authors include this partial in a `Tabs` component.
Also include a link to our installation guide at the end of the partial
for readers who want more information on our package repos.
* document creating SSH servers via IAC
* add links and index page
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* address feedback + fix Var XML tags
* test tctl flow and fill tctl command outputs
* fix kubernetes and terraform documentation
* make docs linter happy
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Remove references to role creation in deployment guides
* Update access guides to demo role creation
* Explain permissions assignment better
* Fix reference to role
Closes#18495
Edit the partial at `docs/pages/includes/kubernetes-access/rbac.mdx` so
it does not require enabling access to an awkwardly named Kubernetes
user based on the current context. Instead, have the user check whether
they can already access Kubernetes users/groups, and if not, assign
their Teleport user a role that can access a view-only group.
* add db ca release versions to docs variables
* update split ca details snippet
* add patch release versions
* link to migration guide
* add all release versions to db ca migrations guide
* Update docs/pages/management/operations/db-ca-migrations.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Improve Linux installation instructions
Closes#32387
In the Installation page, the instructions for installing Teleport on
Linux reuses the partial we use for how-to guides, `install-linux.mdx`.
This is inappropriate for an installation reference, since the partial
is not intended for users interested in a specific package manager. This
change provides a comprehensive description of our package repositories
for Teleport installations on Linux.
Since the Installation page is a common entrypoint for users looking to
get started with Teleport, this change also adds a section to the Linux
installation instructions with recommended pages to follow for setting
up Teleport.
Also, since we have a script available form the corporate Teleport site
that automatically chooses a package manager and configures it to target
a Teleport package repo, this change adds instructions to use this.
I have organized the Linux installation section to place H3 sections
from less work/configuration to more work/configuration, from the
one-line installation script to package manager-specific instructions
and, finally, general information about our package repositories.
* Respond to r0mant feedback
- Remove the version guidance for Cloud users and make the
recommendation for them to enable automatic agent upgrades more
prominent.
- Add instructions for installing `teleport-ent-updater`.
- Add instructions for changing the Teleport version to `cloud` for
Team/Enterprise Cloud in package manager examples. Reorganize the
package manager instructions so there is a single tabbed example of
setting the version. To account for this, refactor the subsections of
the "Linux" section so there is a single H3 for TAR and a single H3
for package repositories.
* Respond to additional r0mant feedback
- Make it clear throughout the section that we recommend using the
one-line installation script, which install the automatic updater for
Teleport Cloud users.
- Condense package repository and TAR archive H3s. By simplifying these
sections, we can make the instructions to use the updater on Cloud
more prominent.
- Warn against using TAR archives with Teleport Cloud, and remove
TabItems for these editions in the TAR archive section.
- Incorporate instructions introduced by #38401 to query the Proxy
Service for the latest compatible version.
* Respond to r0mant feedback
- Remove Teleport Team mention
- Add "(self-hosted only)" to the TAR subsection
- Remove a Tabs component in the TAR section so readers aren't tempted
to interact with the component before reading the initial body text.
* Fix linter errors
- Remove the `team` scope from config.json.
- Edit the Edition comparison table to remove the "Team" column.
- Change the Teleport Team getting started guide to a Teleport
Enterprise Cloud getting started guide.
- Remove other Teleport Team mentions from the docs.
* Add a Discovery Service section
Closes#38741
Add a dedicated sidebar section for the Teleport Discovery Service.
Since the Discovery Service is a separate agent service from the SSH
Service, Kubernetes Service, etc., it makes sense to add a dedicated
section for this service. In the future, we can include configuration
guides, architecture guides, etc. in this section.
To create the new section, this change moves existing auto-discovery
guides from other sections of the docs.
* Respond to hugoShaka feedback
- Move the Kubernetes application discovery docs
- Edit the "Kubernetes Access" intro to include a link to Kubernetes
auto-discovery
* docs: updates to cloud tenant data locations
* spelling fix
* lint fixes
* update verbiage on where ent cloud runs
* Team data storage update in comparsion
See #36816
The docs are inconsistent in using "automatic updates" vs. "automatic
upgrades". Prefer the former to be consistent with the
`teleport-ent-updater` script.
- Replace "automatic upgrade" with "automatic update" in docs pages.
- Replace "automatic upgrade" uses in the `teleport-kube-agent` chart
and regenerate the docs.
- Catch uses of "automatic upgrade" in the `consistent-terms` Vale rule
Fix an incorrect sitemap link. The Teleport docs engine generates the
sitemap based on the contents of `docs/pages`. This directory tree
included a file called `docs/pages/server-access/guides/openssh.mdx`,
but the `config.json` for the docs content included a redirect from this
page to `docs/pages/server-access/guides/openssh/openssh.mdx`, meaning
that a page in the sitemap became inaccessible.
This change fixes the `/server-access` section of the docs to resolve
the sitemap issue. To do so, it creates the `server-access/openssh`
directory and moves OpenSSH guides into this directory. It updates
`config.json` and the Server Access menu page accordingly.
This change also adds a missing meta description to the self-hosted
Access Graph guide.
Gavin Frazar