- Fix clashing reference page titles ("Teleport CLI Reference" and
"teleport CLI reference").
- Add missing redirects: The Teleport blog encountered 404s navigating
to three pages. This change adds redirects for these pages in case
other sites link to them as well.
Fixes#29957
Improves the page load performance of our CLI reference documentation by
splitting up the long CLI reference page. This also has other benefits,
including:
- **SEO**: Users don't need to search for the Teleport CLI reference
(and don't need to know that this page exists), but can search for a
specific tool they want reference docs for.
- **In-page search:** Users searching within a specific page will get
results for the tool they are researching, not all of Teleport's CLI
tools.
* Edit forScopes configurations and edit guides
Closes#26500
This change requires merging gravitational/docs#326 to add a Team scope
to the docs.
This updates pages within the docs so that:
- Each page's `forScopes` configuration is accurate, especially with
regard to support for Teleport Team.
- All scoped components match the `forScopes` configuration for each
page. For this, I used the linter introduced by
gravitational/docs#327.
* Respond to alexfornuto feedback
* Add reviewer and requester roles.
Reviewer and requester roles have been added to allow for easy defaults for
reviewing and requesting applications and user groups for the Okta service.
* Update comments, add in requester/reviewer references all over docs.
* Update constants.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Better names in resource-requests.mdx, no options for reviewer/requester presets.
* Add dbreviewer to cspell.json.
* Update init_test.go to handle the new number of presets.
* Remove access review/request role creation from resource-requests.mdx.
* Improve wording.
* Only add reviewer/requester/group access if in enterprise.
* Docs updates.
* Remove errant scoped block.
* Tune access controls getting started.
* Prevent customer roles from being overwritten by new defaults.
* Apply suggestions from code review
Co-authored-by: Nic Klaassen <nic@goteleport.com>
* Doc updates, function name updates, bootstrap label behavior changes.
* Adjust TeleportManagedLabel comment to sound less dire.
* Remove unnecessary references to reviewer/requester in the docs.
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Docs tweaks, removal of unnecessary login setting.
* Use internal resource type as discussed offline.
* Update api/types/constants.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Nic Klaassen <nic@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Closes#13571
The instructions for the `cert-format` flag of `tsh` commands are a bit
vague in the CLI reference. While #19041 already fixes the `oldssh` flag
value, it's still unclear how `tsh` uses this flag. This change adds
more information. While #13571 indicates that `cert-format` is not a
true global flag, it is still a flag of the `tsh` command (not a
subcommand), so it makes sense to retain it within the "Global flags"
table.
* Add docs for shell completion
* Address Zac's comments
* Apply suggestions from Alex
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Do not mention bash_profile
* update cspell
* Remove 'After that'
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
Closes#12575
Edit the CLI reference to indicate that `tsh ls` can support multiple
label argument values, resolving a longstanding TODO.
Co-authored-by: Steven Martin <steven@goteleport.com>
* [docs] Include File Transfers in moderated sessions docs
* Fix typo
* Add note in tsh scp reference
* Update docs/pages/access-controls/guides/moderated-sessions.mdx
Co-authored-by: Steven Martin <steven@goteleport.com>
* Add screenshot
* Update docs/pages/access-controls/guides/moderated-sessions.mdx
Co-authored-by: Steven Martin <steven@goteleport.com>
* Update moderated-sessions.mdx
---------
Co-authored-by: Steven Martin <steven@goteleport.com>
* Make --reason required for `tctl alert ack`
The backend requires a reason, so by having it optional in the CLI
it just means we have to make a network request in order to get
an error.
Also update the docs to indicate that this is not optional.
* tctl: show acknowledged alerts when the -v flag is provided
* Add a --format flag for tctl alerts ls
This makes it easier to programatically operate on the alerts.
Machine ID is often a better option than `tctl auth sign` when
Teleport certificates are required for automation purposes.
This commit mentions Machine ID as an option in several areas
where we currently recommend the tctl approach.
In the future, we should update some of these guides (or make new
ones) to list Machine ID as the primary approach, but that's a larger
change and I wanted to get something out that can highlight Machine ID
as an option right away.
* Default headless to --mlock=best_effort to reduce errors to a debug
log.
* Add error for non-linux operating systems using headless.
* Add a better mlock error message and add corresponding troubleshooting
docs.
In gravitational/docs#238, we will add a linter that lints for incorrect
usage of Teleport terms. This change fixes linter violations to
anticipate this new linter.
Changes include:
- Ensuring that Teleport service names are capitalized
- No longer using the "[Resource] Access" terminology. Instead, talk
about adding resources, using Teleport services, etc.
* Support spellchecking in docs content
In gravitational/docs#261, we will add a script that checks the spelling
of each version of the docs. This change edits one version of the docs
content to support this, including:
- A cspell configuration file
- A new step in the GitHub Actions in the "Lint (Docs)" workflow that
runs the spellcheck script we will add in `gravitational/docs`
- Fix mispellings so this passes the lint job. The mispellings are in a
file that we generated automatically, but there are few enough of
them, and we haven't merged the auto-generation script yet, that I
think it makes sense to fix them in the generated file for now.
* Respond to PR feedback
- Remove misspellings from the ignore list
- Sort the ignore list (and format it via prettier)
* Use the new yarn spellcheck command
* Spelling fixes
* spell fixes and add words to cspell.json
---------
Co-authored-by: Steven Martin <steven@goteleport.com>
* Export desktop recordings to video
Add a new tsh command that will write Windows desktop recordings
to an AVI file for offline playback. Encoding is done client side
to avoid consuming server resources.
This uses the Motion JPEG codec (https://en.wikipedia.org/wiki/Motion_JPEG)
for its simplicity and ease of use. Something like ffmpeg would perform
better in nearly every aspect (run time, compression / file size, video
quality, etc), but that would complicate our build process and add extra
native dependencies. This implementation uses pure Go and works on any
platform where tsh runs today.
Also make sure `tsh recordings ls` shows Windows and SSH recordings.
* Untangle test imports
lib/events/eventstest is allowed to import lib/events
(it needs to in order to implement interfaces and use types)
This means lib/events can not import lib/events/eventstest,
which requires that we move some tests from package events
to package events_test
* tdp: break dependency on lib/srv
The lib/srv package is large and contains Unix-specific code.
Now that tsh needs to understand the TDP protocol, we need to
avoid importing lib/srv so that tsh can still build on Windows.
* Add GCP Service Account parameter to tctl users add reference
Only applies to master and branch/v12
* Moved azure identities parameter next to other cloud apis ones
Only proxy, node, auth, db, or app are applicable roles. Windows desktop and kube are not supported roles with `teleport start --roles=...`. The default roles if none is specified is proxy, node and auth.
Previously the tokens add would show the command to include these as a role. That was incorrect and has been corrected.
* add device spec docs
* format specifics of key
* add yaml tag
* add collected data
* cli ref update
* Update docs/pages/includes/device-spec.mdx
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
* update example
---------
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
An issue with `gravitational/docs` caused the docs linter to stop
catching issues for a period of time. Now that we have addressed the
linter issue, this change addresses warnings/errors flagged by the
linter.
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Explain Kubernetes RBAC more comprehensively
Closes#18230
This change explains Teleport's RBAC system in relation to the Teleport
Kubernetes Service. The docs didn't leave me with a readily available
place to put this information, since explanations of Kubernetes-related
role fields are scattered in asides throughout various pages.
As a result, I have added a more comprehensive, focused explanation of
Teleport's Kubernetes RBAC system in two places:
- A new how-to guide for setting up Kubernetes RBAC with Teleport using
a local `minikube` cluster.
- A reference guide that explains the Kubernetes-related fields within a
Teleport role as well as the logic that the Kubernetes Service uses to
evaluate these fields. This replaces the existing Kubernetes Access
Controls guide.
To make room for the RBAC how-to guide, I've reorganized the other
guides into a logical sequence: enabling auto-discovery, manually
registering clusters, and setting up access controls.
I've also edited the Resource Access Requests guides to explain role
fields for the different resources you can restrict access to via
`search_as_roles`, including `pods`.
* Partially respond to PR feedback
- Add `kubernetes_labels` to example snippets
- Rename a misleading H5 in the Resource Requests guide
- Make the description of impersonation more accurate in the Access
Controls guide
- Move a Notice in the Access Controls guide
- Add an example role to the warning re: namespace restrictions in the
Access Controls guide
- Make resource filtering info more accurate in the CLI reference
* Change the RBAC how-to guide
Use Deployments in the demo cluster instead of Pods, showcasing the use
of regular expressions in per-pod RBAC.
This responds to PR feedback.
* Provide an example of internal traits
This responds to PR feedback
* Add notes about regex support
Responds to PR feedback
* Explain multiple values in labels
Responds to PR feedback
* Document progressively enabling access to pods
In response to PR feedback
* unbreak redirect
* copy edits
* more copy edits
* Respond to alexfornuto feedback
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Document Google Cloud CLI access
Closes#17584
- Add a guide to configuring and using Google Cloud CLI access via the
Teleport Application Service.
- Since we now have three guides to setting up secure access to cloud
APIs, create a new subsection of the "Application Access" docs section
related to cloud provider APIs.
* Respond to PR feedback
- Capitalize "JSON Web Tokens"
- Edit the AWS guide's nav bar entry
- Fix garbled section in the App Access intro page
- Improve the service account name we use in the how-to guide
- Clarify the way the App Service uses a service account
- Add new env vars to the `tsh proxy` command output
- Other small changes in response to suggestions/comments
* Edit instructions for starting the VM
Add instructions to launch a new VM with a service account attached.
This addresses feedback on the PR.
* Use more precise terminology for service accounts
This addresses feedback on the PR
* Add information about `tsh gsutil`
This adds to both the Google Cloud API access how-to guide and the CLI
reference.
* Respond to PR feedback
* use nobr tags
* fix multiline command
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Add device trust documentation
* Link to Device Trust from Access Control pages
* Document `device_trust` authentication section
* Document the `tsh device enroll` command
* Document `tctl devices` commands
* Review: Explain macOS restriction in text
* Review: Address Alex's comments
Indents, markdown style, code block style, punctuation and missing
words.
* Review: Use diff blocks on `tctl edit` example
* Review: Use diff blocks in other examples
* Review: Use standard example names
* Review: Address Alex's comments (2)
Uppercase SERIAL, macOS enroll notice, config example tabs.
* Review: Sort `tctl devices` commands alphabetically
* Review: Use config variables for asset_tag and enroll_token
* Review: Remove '#' from code blocks in cli.mdx
* combine warning and ScopedBlock
A ScopedBlock for OSS will never render on a page not scoped for OSS. This way, it's always visible. Once the feature is out of preview, we can just remove the first line.
* clarify device trust between trusted clusters
This addition dispells any assumptions made by the reader that applying device trust to root clusters would enforece the setting on leaf clusters.
* update enterprise tctl version output
---------
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Document Azure CLI access
Closes#17583
- Create a guide to Azure CLI access
- Update references to reflect changes to roles, commands, and the file
config
* Respond to alexfornuto feedback
* Add a section to the guide on `tsh proxy azure`
* Respond to smaller feedback items from Tener
* Switch the order of role approaches
Responds to one item of feedback from Tener.
* Respond to zmb3 feedback
* Document new behavior
- Wildcards in `deny` rules
- The `tsh proxy az` alias
* Add SSO instructions for defining a role
* Update env var values
* optimize images
Co-authored-by: alexfornuto <alex.fornuto@goteleport.com>
* Add a glossary of Teleport terms
Closes#16121Closes#13363
- Create a Core Concepts page based on the Architecture Overview page.
The Overview page is an outline of core concepts, so I thought it
would make a good starting point for the glossary.
- Add the Core Concepts page to the Home section to make it more
prominent for users who are visiting the docs homepage. This should
give it more traffic than leaving it in the Architecture section.
- Move definitions out of the "Definitions" table. Since this table
repeats content from the body sections and comes after them, it makes
sense to condense all content into brief body sections.
- Alphabetize sections
- Bold the first instance of each keyword within a given section. Not
adding links since these are all to the same page. It might get a bit
confusing to click a link and not see a change in view, since the
target section would already be on the page.
- Remove the intro paragraph of the old Overview page, since it's not
strictly related to core concepts.
* Respond to PR feedback and add further edits
- Group definitions into H3-level sections organized into H2s, improving
readability by presenting the more central components first.
- Group "Machine ID" with "Teleport Services" to simplify the glossary.
- Call instances of a Teleport Service an "agent". This is consistent
with our source and informal language about Teleport. This also
removes the "Node" terminology, which is prone to misuse (does it mean
"a Service instance"? An "SSH Service instance"? Both are present in
the docs) and easily confused with the lowercase "node" (i.e., a
host).
- For simplicity, remove the term "Teleport Process" and simply explain
that multiple Teleport Services can run via the same binary.
- Add a section on Teleport's editions, including the terms "Community
Edition", "Enterprise", and "Enterprise Cloud".
- Remove the mention of Teleport Discover, which isn't documented yet.
- Minor wording/readability changes.
* Respond to PR feedback
* Respond to zmb3 feedback
Paul Gottschling