* Log UDS sourced peer info
* Add logging of peer address when non-unix
* Properly group logging attributes when svid is issued
* Add config structs for unix workload attestation and tests
* Add test for entire bot config
* Return `PermissionDenied` when no SVIDs available as per SPIFFE Workload API 5.2.1
* Filter down SVIDs based on workload attestation
* Add improved logging
* Add basic unit test
* Add e2e test that uses workload attestation
* Document workload attestation features
* Add `database-tunnel` service to Machine ID reference
* Update docs/pages/machine-id/reference/configuration.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Modify `tbot` docs to show `--proxy-server`/`proxy_server` in preference to `--auth-server`
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/deployment/kubernetes.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Add fields for to-be-supported token claims
* Modify validation to include new field
* Add comparisons for new fields to joining logic
* Add support for globby matching for sub, ref, namespace_path and project_path
* Document which fields support globby matching
* Add tests for join rule engine changes
* Regenerate operator CRDs
* Add docs for new fields
* Correct punctuation in error message
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Correctly use GoDoc-esque comments
* Address docs comments
* Reuse glob matching code
* Correct type of RunnerID field
---------
Co-authored-by: Marco André Dinis <marco.dinis@goteleport.com>
* Skeleton out docs refactor (#31017)
* Start outlining index pages
* More reshuffling
* Remove old guides index page
* Adjust sidebar config
* Fix redirect
* Fix crosslinks
* Fix changelog links
* Fix more links
* Add short descriptions for platform guides
* Improve some page descriptions/signposting
* Nicer title
* Outline intro page
* Add notes on common usecases
* Remove old sections from introduction
* Start to outline overview topics
* Roughly expand on overview to cover bot user/bot role
* Clarify usecases
* Attempt to break up further reading section to be intelligible
* SPAG
* Add TODOs
* Machine ID Docs Refactor: Kubernetes Platform Guide + some AWS/GCP (#31796)
* Add config files needed for Kubernetes deployment
* Tidy examples under defined headers
* Add namespace to specs
* Add notes on join methods
* Further details on Kubernetes joining
* Document kubernetes rbac resources
* Skeleton out GCP/Linux platform guides
* Add necessary topics to the background for GCP and Linux
* Try and rewrite the blank role mdx to be less rubbish
I'm pulling my hair out over this lol
* Add a todo so I can come back to this part of the description when i can use words
* Further flesh out the background shape and intor shape for the platform guides
* Add more steps to k8s guide
* Fix links to k8s page
* Explain `kubernetes` join method
* Add documentation to the token yaml
* Add reasoning for role
* Document deployment manifest
* Add notes on determining if the deployment is healthy.
* Add token yaml for aws/gcp from my reference notes
* Add token/bot creation step for aws,gcp,linux
* customizing
* Machine ID Docs Refactor: Add `tctl` and `terraform` access guides (#32036)
* Outline `tctl` access doc
* Flesh out Terraform page with an example
* Fill out the copy for the Terraform provider guide
* Add explanation to configure tbot step of Terraform guide
* Add similar explanatory prose to tctl.mdx
* Add example role for tctl guide
* Try to better explain modifying the existing role
* Fix prerequisites
* Note on configuring permissions
* Fix SPAG
* Appease linter
* Expand intro for Terraform
* Please linter with newlines
* Remove spurious newline
* Clarify install/confgiure language
* Update docs/pages/machine-id/access-guides/tctl.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/access-guides/tctl.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/access-guides/tctl.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/access-guides/terraform.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove bactics from title
* Make example roles less powerful
* Add example of tctl command to check success
* Correctly say platform guide not access guide
* Be more specific in mentioning `tbot`
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Remove V11 support warnings from platform guides
* Machine ID Docs Refactor: Linux VM based Platform Guides (#32472)
* Add pre-requisites
* Add example systemd service
* Notes on oneshot mode
* Offer daemon or oneshot mode docs
* Hide one-shot mode from `token` join based Linux
* Clarify Linux user for access
* Use variables for the token and explain commands
* Explain creating systemd service
* Explain when to prefer one-shot mode
* Add skeleton for Azure
* Document azure join token fields
* Add intros for guides
* Explain why we protect the directory
* Add install instructions
* Remove step regarding writing token to a seperate file
* Move coinfigure outputs to template
* Signify each step as local machine or target host
* Explain gcp/azure join methods
* Explain token and iam join methods
* Remove no longer recommended host certs guide
* Add next step
* Correct list of supported join methods
* Machine ID Docs Refactor: Rewrite GitLab and CircleCI guides (#32834)
* Start reshaping the circleic guide
* Make some changes to the GitLab side as well
* Add role creation to GitLab guide
* Add role creation step to CircleCI guide
* Adjust token file name
* Make sure anonymous telemetry advice is included
* Machine ID Docs Refactor: GitHub Actions docs (#32854)
* Start restructuring GHA guides
* Copy in Kubernetes Action example
* Add example DIY workflow
* Adjust examples with replacement steps
* Link off to the action github pages
* Tidy up introduction for GHA guide
* Explain GHA examples better and more searchably
* Improved title
* Add example role modifications
* Machine ID Docs Refactor: Ansible Access Guide (#32741)
* Rework Ansible with Server Access guide
* SPAG and consistency suggested changes
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Clarify intro and use the variable throughout
* suggested fixes
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Clarify configuring bot rbac
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Machine ID Docs Refactor: Application Access (#32745)
* Rework Application Access docs
* Code review suggestions
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Clarify RBAC
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Machine ID Docs Refactor: SSH Access guide (#32735)
* Add prereqs for ssh access guide
* Outline steps and output config
* Add guidance on tsha nd OpenSSH
* Guidance on other tools
* Simplify guidance on other tools
* Link to ansible guide
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Reorganise RBAC section
* Fix miscopied sentence
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Machine ID Docs Refactor: Architecture and Introduction (#32901)
* Rewrite getting started guide next steps
* Rewrite introduction introduction to focus on tangible machine ID benefits
* Overview
* Add todo markers
* Rewrite overview
* Rewrite some of the architecture page
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Rearrange "overview" to act as "concepts"
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Machine ID Docs Refactor: Database Access (#32743)
* Rewrite database access guide
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Clarify that systemd should be used rather than exercise for reader
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Machine ID Docs Refactor: Kubernetes Access (#32744)
* Rewrite Kubernetes access guide
* Code review suggestions
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Explain need for kubectl on both client machine and machine id host
* spag
* Fix `kubernetes_resources` example
* Further clarify `kubernetes_resources`
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Edit the Machine ID docs refactor (#33596)
* Edit the Machine ID docs refactor
- **Rename the new guides:** Use the "Connect a Bot" and "Deploy Machine
ID" language instead of "Access Guides" and "Platform Guides" to
connect these guides more explicitly to the language we use in the
"Concepts" discussion of the Machine ID landing page.
- **Add context to the deployment guide index page**: Reduce repetition
and provide information about each deployment method to help users get
more context about how Machine ID runs and joins a cluster, as well as
to help users choose a deployment guide.
- **Make links more visible on the Machine ID intro page:** Use a video
banner for the Machine ID intro so it takes up less space on the page.
Shorten some sections and add more specific H2s for the links.
- **Streamline some deployment guides:** Where guides include
"Background" and "Guide" H2s, blend the introductory information with
the guide so we can promote the "Step" H2s to H3s and direct the reader
to the step-by-step instructions more quickly.
- **Add new pages to the docs table of contents.**
* Respond to zmb3 feedback
- List cloud platforms before CI/CD platforms on the sidebar
- Recommend using platform-signed identity documents in the deployment
guide intro page.
- Edit language introducing join tokens.
* Respond to strideynet feedback
- Edit wording in the deployment guide index page, including renaming a
section heading and adding language re: renewable certs in the static
token join method.
- Change GitHub Actions link.
- Rename the Access Guides back to "Access Guides"
* Fix spelling
* Appease linter
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Change Open source and OSS to Teleport Community Edition
* Change open-source to Teleport Community Edition
* Role access requests in the nav and title
* Hash out fundamentals of a Kubernetes Secret destination (it works!)
* Propagate context through Init()
* Propagate context.Context through Destination.Write
* Propagate context.Context through destination.Read
* Use _ for unused context.Contexts
* Add docs for `kubernetes_secret` destination
* Basic tests for DestinationKubernetesSecret
* Add test based on fake k8s client
* Require init before usage
* Refine documentation for kubernetes_secret destination
* Improve logging when secret is created
* Fix test
* Fix imports
* Fix lock copy
* Use dry run for initialization
* Ensure same destination is not reused
* Get started on V14 tbot changes
* Update applications.mdx for new config format
* Rearrange databases guide
* Flesh out guidance on migration
* Fill out more of configuration.mdx page
* Add more verbose config explanations
* Add more output documentation
* Use common include file
* Tweak descriptions for destination types
* Rewrite docs for directory dest
* Update language used in Architecture guide
* Add principals to ssh_host docs
* Fix mispelt ssh_host output type
* Update other guides with config v2
* Add version warning to guides re: v2 config
* Add guidance on migration failure
* Remove reference to Application Access/Database Access
* Use database server rather than database service
* Reword for clarity and conciseness
Co-authored-by: lsgunn-teleport <136391445+lsgunn-teleport@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: lsgunn-teleport <136391445+lsgunn-teleport@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Rename common-output-config.mdx
* Reflow and change title in upgrade guide
* Remove scoped configs
* Apply suggestions from code review
Co-authored-by: lsgunn-teleport <136391445+lsgunn-teleport@users.noreply.github.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: lsgunn-teleport <136391445+lsgunn-teleport@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: lsgunn-teleport <136391445+lsgunn-teleport@users.noreply.github.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Apply suggestions from code review
Co-authored-by: lsgunn-teleport <136391445+lsgunn-teleport@users.noreply.github.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use code block for example command
* Dont use list for definitions
* Use full name of ACL
* Add brief description of outputs field
* Fix up host certificate guide
* Reflow FAQ
* Specify fields that need replacing in jenkins guide
* Clarify "join token" in database joining docs
---------
Co-authored-by: lsgunn-teleport <136391445+lsgunn-teleport@users.noreply.github.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
In gravitational/docs#238, we will add a linter that lints for incorrect
usage of Teleport terms. This change fixes linter violations to
anticipate this new linter.
Changes include:
- Ensuring that Teleport service names are capitalized
- No longer using the "[Resource] Access" terminology. Instead, talk
about adding resources, using Teleport services, etc.
* Skeleton out docs for GitLab joining
* Adjust description of guide
* Add more GitLab docs
* Explain the possible constraints
* Add final example of GitLab CI
* Correct token name
* Further clarify a few parts of the documentation
* Correct example of project_path constraint
* Add more specific link to GitLab docs
* Update docs/pages/machine-id/guides/gitlab.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update docs/pages/machine-id/guides/github-actions.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update docs/pages/machine-id/guides/gitlab.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* add new guide to navbar
* Update docs/pages/machine-id/guides/gitlab.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/machine-id/guides/github-actions.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/machine-id/guides/gitlab.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/machine-id/guides/gitlab.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Update docs/pages/machine-id/guides/gitlab.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* More concise/precise language in bot creation
* Add further explanation of fields
* Update docs/pages/machine-id/guides/gitlab.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Add reference page for gitlab joining
* Fix link
* line break adjustments
* note bot role is built in
* Minor spag correction
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* spag changes
* Use `tctl` partial
* Further readability changes
* "we" -> "you"
* Further succincty
* Adjust referneces
* show format
* Finaly few copy fixes
* missing y
* Update docs/pages/machine-id/guides/github-actions-kubernetes.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Clarify Teleport user privs
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Organize docs guide sections chronologically
This change aims to make docs navigation easier by organizing some docs
sections according to the sequence of steps a user would take to set up
Teleport.
The current docs organization uses a variety of categories and schemes
to organize the docs. For example, there is a "Home" section that
includes the Changelog, Installation page, and Getting Started guides; a
"Setup" section that includes references and admin guides; and
edition-specific sections (Enterprise, Cloud). For a user who is setting
up Teleport--or who has already done some setup work and wants more
advanced instructions--it's difficult to know where in the docs to find
the right information.
This change organizes our how-to guides into the following categories
that describe the process of setting up Teleport:
- Try out Teleport
- Deploy a Cluster (including choosing an edition)
- Configure Access (including SSO, RBAC, and Access Requests)
- Manage your Cluster (admin guides, operations, etc.)
- Use Teleport (this section already exists)
I moved the Reference section after this chronology, since users can
access the reference guides anywhere in the setup process.
As part of the change, I have also moved the content from the
"Enterprise" and "Cloud" sections into "Deploy a Cluster", since this
content has to do with how to deploy a specific edition of Teleport.
Note that this change does _not_ attempt to reorganize our
protocol-specific sections. While adding resources is part of the
Teleport setup process, we have a lot of content in our
protocol-specific sections, and moving it all into a single section
related to adding resources to a cluster would (a) exceed the maximum
depth for subsections in the nav bar and (b) cause more confusion than
it alleviates.
* Respond to PR feedback
- Create a "Compliance Frameworks" section of "Configure Access" with
the FedRAMP and SOC 2 guides
- Rename "Use Teleport" to "Connect your Client"
- Move the database GUI client guide into "Connect your Client"
* Add redirects
* Fix linter issues
This changes tbot's configuration to access the token via a
getter/setter instead of a direct property, to allow us to fetch the
token (possibly reading it from a file) when we need it instead of when
the configuration is created.
This also changes the identity fetching logic, to try and read the token
when there is an identity present but not error, allowing for the token
file to have been deleted between restarts. If it can read the token,
it'll check to see if it has changed and refetch the identity if so.
* Added Machine ID and Web Apps Guide.
Co-authored-by: Tim Buckley <tim@goteleport.com>
* Update reference pages with latest v9.3 content
Also, update the mongodb example
* Address review feedback
* Remove unfinished though and fix a few typos
* Tweak wording for the webapps guide
Also, fix broken lints in the go examples.
* Fix Postgres example
* Rename "webapps" guide to "database" guide (with custom app)
* Apply suggestions from code review
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
* Address review feedback
* Fix go.mod issue breaking linter, remove duped postgres library
* Fix broken links
* Rephrase the final sentence a bit.
* Update docs/pages/machine-id/guides.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* First batch of review feedback
* Apply more suggestions from review
* Restore original go.sum / go.mod
* Show different version requirement text for cloud vs OSS/enterprise
* Add small note about `tbot db` limitations
* Add new Machine ID / Database Access diagram
* Fix lint errors
* Fix broken link
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Address review feedback
* Fix whitespace
* Address review feedback
* Update docs/pages/machine-id/guides/databases.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Russell Jones <rjones@gravitational.com>
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
We will be adding a linter rule that prohibits Details boxes that lack
titles, letting us implement the ability to link directly to a Details
box. In some places in the docs, Details boxes are used purely to
adjust the visibility of Markdown based on scope. Now that we have a
ScopedBlock component, we can use this instead.
This fixes a smaller error showing invalid YAML in the Machine ID
reference configuration. While we do support a shorthand directory
path as just a string, the two cannot be combined.
This changes the documented recommendation to always use the more
verbose form where `path` and other directory-specific options are
fields on a `directory` object.
Noah Stride