* Break up /database-access/guides/
Closes#17641
Organize the guides to enrolling databases in specific cloud providers
(or self-hosted databases) into separate subsections of the "Database
Actions" section, organized by cloud provider (or self-hosted).
We can later add general information to the index page of each
subsection about how Teleport database access works for each cloud
provider. The remaining guides in the "Guides" subsection have to do
with database-agnostic functionality of the Teleport Database Service.
This change also adds a redirect for each page it moves.
* Respond to greedy52 feedback
- In the "Database Access" intro page, move the self-hosted section
first in the list of links to database-specific guides so it's less
easy to miss.
- Change "AWS" to "Amazon" in product names.
* Fix linter issues
* Remove redirects added by the DB guide reorg
This prevents us from running into Vercel route limit issues, since the
number of redirects is large.
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
This PR allows users to set `clusterDomain` to match Kubernetes Cluster
domain address when running clusters with non default cluster domains.
Fixes#41165
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
Also removes the outdated mention of locking accounts after failed
password reset attempts. This functionality was removed in #35325
but the docs were not updated.
Closes#41135
* Add TPM to join method reference page
* Skeleton out the Linux/TPM guide
* Add yaml for join token
* Flesh out TPM joining guide
* Try var
* Add note on FIPS 140-2 compliance
* Add more vars
* ADd more background to how TPM joining works
* Clarify statement on most secure
* Add `tbot tpm identify` to cli reference
* Rename background to `how it works`
* Update docs/config.json
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/includes/tpm-joining-background.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/deployment/linux-tpm.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use Create A Bot template
* Expand TPM
* Reword tpm joining background
* Fix trailing ,
* Mention enterprise licensing
* cspell
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Configurable podSecurityContext for auth and proxy deployments
* Lint podSecurityContext for Teleport Cluster chart
* Test podSecurityContext for auth and proxy deployments
* PodSecurityContext schema for Teleport Cluster chart
* Document podSecurityContext for Teleport Cluster chart
---------
Co-authored-by: Niek den Breeje <n.denbreeje@guardian360.nl>
* Document Azure CLI setup for AKS with Entra Workload ID
* add How it works section
* address review comments from Tener
* address comments from Paul
* try to fix lint and add version info
* Mentioned in the documentation that we ignore "kube-system" and "kube-public" namespaces for kube app discovery.
* Use admonition
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Rerender kube agent docs
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
Updates the resource parser with two new functions: `contains` and
`split`. When used together they provide the ability to
search for resources that have labels with multiple values in a
delimited list. For example, if a resource has label `foo=bar,baz,bang`
then `split(labels[foo], ",")` would transform the
comma label value from a string into a list: ["bar", "baz", "bang"]
The list could then be fed to `contains` to determine if bar exists
in the list: `contains(split(labels[foo], ","), bar)`.
Closes#38824
In the Networking reference, the discussion of environment variables
didn't make it sufficiently clear that `/etc/default/teleport` is the
environment file specified in the Teleport unit file.
This change includes the unit file to make it more explicit how the file
uses `/etc/default/teleport`.
* Modify `tbot` docs to show `--proxy-server`/`proxy_server` in preference to `--auth-server`
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update docs/pages/machine-id/deployment/kubernetes.mdx
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
- Remove the `team` scope from config.json.
- Edit the Edition comparison table to remove the "Team" column.
- Change the Teleport Team getting started guide to a Teleport
Enterprise Cloud getting started guide.
- Remove other Teleport Team mentions from the docs.
* Add a Discovery Service section
Closes#38741
Add a dedicated sidebar section for the Teleport Discovery Service.
Since the Discovery Service is a separate agent service from the SSH
Service, Kubernetes Service, etc., it makes sense to add a dedicated
section for this service. In the future, we can include configuration
guides, architecture guides, etc. in this section.
To create the new section, this change moves existing auto-discovery
guides from other sections of the docs.
* Respond to hugoShaka feedback
- Move the Kubernetes application discovery docs
- Edit the "Kubernetes Access" intro to include a link to Kubernetes
auto-discovery
* Update TAG version to 1.11.0
* Add a guide for deploying TAG using Helm
* Fix prose lint
* Add auto-generated reference for TAG Helm chart
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update TAG example role to v7
* Fix link to TAG Helm guide
* Pin TAG Helm chart version
Pins to the same version as TAG itself,
Helm chart and TAG are versioned in lockstep
* Call out the teleport Helm chart more explicitly
* Bump TAG version to 1.13.0
Expecting it to be released by the time these docs go live.
* Replace teleport-cluster parameters with Vars
* Elaborate trust of the TAG CA in Teleport
* Fix the marker style
* Fix the link to teleport-cluster reference
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
See #36816
The docs are inconsistent in using "automatic updates" vs. "automatic
upgrades". Prefer the former to be consistent with the
`teleport-ent-updater` script.
- Replace "automatic upgrade" with "automatic update" in docs pages.
- Replace "automatic upgrade" uses in the `teleport-kube-agent` chart
and regenerate the docs.
- Catch uses of "automatic upgrade" in the `consistent-terms` Vale rule
Fix an incorrect sitemap link. The Teleport docs engine generates the
sitemap based on the contents of `docs/pages`. This directory tree
included a file called `docs/pages/server-access/guides/openssh.mdx`,
but the `config.json` for the docs content included a redirect from this
page to `docs/pages/server-access/guides/openssh/openssh.mdx`, meaning
that a page in the sitemap became inaccessible.
This change fixes the `/server-access` section of the docs to resolve
the sitemap issue. To do so, it creates the `server-access/openssh`
directory and moves OpenSSH guides into this directory. It updates
`config.json` and the Server Access menu page accordingly.
This change also adds a missing meta description to the self-hosted
Access Graph guide.
* Update backend reference with working proxy configuration
the local loopback does not work in this case. After discussing internally, recommendation is to use 0.0.0.0 for the diag addr but with a warning this should NOT be exposed to the public internet or used on other instances
* Update backends.mdx
* Update docs/pages/reference/backends.mdx
Co-authored-by: Steven Martin <steven@goteleport.com>
* Update docs/pages/reference/backends.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update backends.mdx
* Update docs/pages/reference/backends.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
---------
Co-authored-by: Steven Martin <steven@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Recommend on-demand mode and continuous backups in DynamoDB docs
Removes mention to provisioned mode and manually setting capacity
in favor of using on-demand mode. Enabling continuous backups was
also elevated into the main configuration reference since they are
strongly encouraged.
Additionally all occurrences of `back-end` were replaced with
`backend` to be consistent with all other usages.
* remove autoscaling references from aws chart docs
* Add new `tctl bots update` command
This adds a new command to update roles and logins for existing bots,
with flags to both set and append as desired.
changelog: Add new `tctl bots update` command to update bot roles and logins
* Pluralize "add-" flags for consistency
* Add docs for `tctl bots update`
Also merges in some other misc docs changes for `tctl bots ...`
* Fix docs lint
* Fix incorrect example
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Use the bot service's `UpdateBot()` RPC instead of modifying directly
This switches to use the new `UpdateBot()` RPC instead of modifying
the bot user and role directly. Also, tweaks CLI messaging to be a
bit less chatty.
* Update tool/tctl/common/bots_command.go
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Move set functions into their own reusable package
The set package adds a little extra functionality but is still
missing various important functions, like subset/superset,
difference, intersection, xor/symmetric difference, etc.
This changes the API slightly, so the tctl command is updated to use
the new package.
* Remove duplicate tests
* Reword flag help strings for clarity
* Remove set abstraction
Removes the Set package and unrolls all related function calls in
bots_command.
* Add unit tests for `updateBotLogins()` and `updateBotRoles()`
This also makes a minimal API wrapper interface for mocking.
* Use utils function to convert sets to a string slice
* Update docs/pages/reference/cli/tctl.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Paul Gottschling