* Break up /database-access/guides/
Closes#17641
Organize the guides to enrolling databases in specific cloud providers
(or self-hosted databases) into separate subsections of the "Database
Actions" section, organized by cloud provider (or self-hosted).
We can later add general information to the index page of each
subsection about how Teleport database access works for each cloud
provider. The remaining guides in the "Guides" subsection have to do
with database-agnostic functionality of the Teleport Database Service.
This change also adds a redirect for each page it moves.
* Respond to greedy52 feedback
- In the "Database Access" intro page, move the self-hosted section
first in the list of links to database-specific guides so it's less
easy to miss.
- Change "AWS" to "Amazon" in product names.
* Fix linter issues
* Remove redirects added by the DB guide reorg
This prevents us from running into Vercel route limit issues, since the
number of redirects is large.
* dont allow disabling second factor
* update docs for 2fa change
* add environmental variable to work around disabled 2fa
* check if its cloud
* update todos
* add a test
* introduce insecure test mode
* fixes for tests
This PR allows users to set `clusterDomain` to match Kubernetes Cluster
domain address when running clusters with non default cluster domains.
Fixes#41165
Signed-off-by: Tiago Silva <tiago.silva@goteleport.com>
* Configurable podSecurityContext for auth and proxy deployments
* Lint podSecurityContext for Teleport Cluster chart
* Test podSecurityContext for auth and proxy deployments
* PodSecurityContext schema for Teleport Cluster chart
* Document podSecurityContext for Teleport Cluster chart
---------
Co-authored-by: Niek den Breeje <n.denbreeje@guardian360.nl>
* Mentioned in the documentation that we ignore "kube-system" and "kube-public" namespaces for kube app discovery.
* Use admonition
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Rerender kube agent docs
---------
Co-authored-by: Hugo Shaka <hugo.hervieux@goteleport.com>
* Add a Discovery Service section
Closes#38741
Add a dedicated sidebar section for the Teleport Discovery Service.
Since the Discovery Service is a separate agent service from the SSH
Service, Kubernetes Service, etc., it makes sense to add a dedicated
section for this service. In the future, we can include configuration
guides, architecture guides, etc. in this section.
To create the new section, this change moves existing auto-discovery
guides from other sections of the docs.
* Respond to hugoShaka feedback
- Move the Kubernetes application discovery docs
- Edit the "Kubernetes Access" intro to include a link to Kubernetes
auto-discovery
* Update TAG version to 1.11.0
* Add a guide for deploying TAG using Helm
* Fix prose lint
* Add auto-generated reference for TAG Helm chart
* Apply suggestions from code review
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
* Update TAG example role to v7
* Fix link to TAG Helm guide
* Pin TAG Helm chart version
Pins to the same version as TAG itself,
Helm chart and TAG are versioned in lockstep
* Call out the teleport Helm chart more explicitly
* Bump TAG version to 1.13.0
Expecting it to be released by the time these docs go live.
* Replace teleport-cluster parameters with Vars
* Elaborate trust of the TAG CA in Teleport
* Fix the marker style
* Fix the link to teleport-cluster reference
---------
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
See #36816
The docs are inconsistent in using "automatic updates" vs. "automatic
upgrades". Prefer the former to be consistent with the
`teleport-ent-updater` script.
- Replace "automatic upgrade" with "automatic update" in docs pages.
- Replace "automatic upgrade" uses in the `teleport-kube-agent` chart
and regenerate the docs.
- Catch uses of "automatic upgrade" in the `consistent-terms` Vale rule
* Change Open source and OSS to Teleport Community Edition
* Change open-source to Teleport Community Edition
* Role access requests in the nav and title
* Add how to verify the binaries are FIPS-compliant
* Clean up some wording and typos
* Typo and spellchecker update
* Links to headings changes
* Path to the link was missing the file extension
* Modify regions that support FIPS/FedRAMP
* Replace version, git, and go version with variables
* Add main documentation for Kubernetes Apps Discovery
* Improve wording.
* Add internal link for annotation
* Improve wording.
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Remove unneeded symbol
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Improve wording.
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Make example cluster names consistent
* Restructure the Kubernetes app discovery guide (#31606)
- Move the docs to the Application Access section, since this material
has to do with proxying applications via the Application Service.
- Split up the guide into separate guides for different documentation
purposes: a how-to guide, configuration reference, and architecture
guide.
- Fix linter/spelling issues
* Add not about running agent inside the Kuberentes cluster
* Add instruction how to enabled kube app discovery on existing installation
* Add example of configuration of teleport-kube-agent Helm chart
* convert tip to tabs
* fix wrong ref
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
* Link to azure guide
* ToC
* initial version of the azure helm guide
* Use <Var> in section 3 and later
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Use TabItem, tweak values.yaml and dns
* hint for non-Azure DNS users
* it's ClusterIssuer, not GlobalIssuer
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Recommend --version
Co-authored-by: Gus Luxton <gus@goteleport.com>
* Update docs/pages/deploy-a-cluster/helm-deployments/azure.mdx
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* spelling fixes
---------
Co-authored-by: Gus Luxton <gus@goteleport.com>
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* feat: add in podmonitor to teleport-kube-agent helmchart
* fix: backport fixes to linting and tests to teleport-cluster chart
* docs: document the `podMonitor` field in chart references
* Apply suggestions from code review
* Lint
---------
Co-authored-by: ThameezBo <thameezbo@double.cloud>
* Add Kubernetes/Helm instructions to the RDS guide
Closes#27753
Add "Kubernetes" tabs as counterparts to Linux host instructions,
following the structure we have used in Access Request plugin guides:
where we show how to install Teleport on a VM, include `helm repo add`
instructions. And when we show how to run a Teleport service, include
`helm install` instructions.
In this guide, I've hardcoded a Teleport configuration file in order to
run `teleport db configure bootstrap`, then inserted the config file
into a Helm values file.
This change also includes instructions to use a local `teleport` binary
in order to bootstrap IAM resources.
This also adds minor formatting and readability changes, e.g., the `Var`
component.
* Respond to alexfornuto feedback
* Update docs/pages/database-access/guides/rds.mdx
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* Fix linter warnings
* Add Service Account IAM instructions
Frame the guide around authenticating the Teleport agent pod's service
account via the IAM OIDC provider.
* Respond to stevenGravy feedback
* Minor tweaks
- Ensure `Var` names are consistent
- Use obviously fake values for resource URIs
- Use the correct value for the OIDC issuer ID
* Respond to alexfornuto feedback
* Fix spelling
* Fix linter issues
---------
Co-authored-by: Alex Fornuto <alex.fornuto@goteleport.com>
* helm: Add ingress template
* helm: Add ingress support
With the changes introducing automatic websocket upgrades for TLS routing in Teleport 13, we can finally add support for a Kubernetes ingress.
* Remove unnecessary brackets
* Tidying
* Gating
* Fix lint and schema
* Fix lint examples
* Handle wildcards
* Tidy up wildcard support
* Don't add AWS annotations when using ingress
* Update AWS docs to use Ingress/ALB with ACM
* Automatically listens on 443, make values simpler
* Support ingress.spec overrides
* Enable ingress and set spec.ingressClassName
* Update values schema
* typo
* Whitelist 'healthcheck' for spellcheck
* Address Hugo's comments from code review
* Apply Paul's comments from code review
* Few more docs fixes
* Update teleport-cluster reference
* Add values file and fix lint/tests
* Fix docs lint
* Add proxy_service.trust_x_forwarded_for when ingress is enabled and Teleport version >=14
* Fix semver check for pre-releases
* Indent ingress section correctly
* Address docs feedback from Hugo/Tiago
* Add warning about using tsh with ingress
* Fix lint spelling
* Add instructions for checking AWS LB controller installation
* Whitelist ingressclass in spellcheck
* What a stupid error
* Promote IAC docs for agents and dynamic resources
Closes#27382Closes#25418Closes#25442
Two aspects of setting up a Teleport cluster are omnipresent in the docs
but never get dedicated treatment:
- Running agents
- Applying dynamic resources
As a result, it is difficult to include discussions about those topics
that are separate from a specific workflow or how-to guide. One glaring
absence has been prominent guidance on using infrastructure-as-code
tools to achieve these tasks.
This change improves the visibility of Teleport's support for
infrastructure-as-code tools by:
- Creating top-level docs sections for running agents and applying
dynamic resources
- Making IAC instructions prominent within these sections
The intention is for readers to become familiar with different methods
of applying dynamic resources and running agents, including how to do
this with IAC, so they can apply this knowledge when reading other parts
of the docs.
As a result, in the docs sidebar, the "Dynamic Resources" section comes
before the section on RBAC, and the "Teleport Agents" section comes
before the sections related to individual Teleport services
("Application Access", "Server Access", etc.).
The new section on dynamic resources also gives us a place to put other
guides to using the Terraform provider and Kubernetes Operator, e.g., if
we add guides to using these tools with popular GitOps platforms.
Likewise, the section on agents gives us a place to put other agent-wide
information, e.g., how to enable an additional Teleport service on an
instance that is already running.
To allow for these changes, I have also made the following, more
tangentially related sidebar changes:
- **Renamed sidebar sections to be noun phrases instead of verb
phrases:** Currently, one half of the sidebar is made of imperative
phrases like "Manage Access" and "Manage your Cluster". This doesn't
really work for the sections on agents and dynamic resources, so I
have renamed these sections for consistency.
- **Moved the "Manage your Cluster" and "Deploy a Cluster" sections**: I
have arranged the sidebar so more basic topics (i.e., those that new
users and experienced users alike will need to be familiar with) are
on the top and more advanced ones are on the bottom.
The other sections that are currently in the first half of the sidebar
are topics that all Teleport users will need to get familiar with,
while day two operations and self-hosted production deployments are
more advanced topics.
- **Edited the landing page:** I have edited the landing page of the
docs to reflect the new sidebar organization. This also makes the page
shorter, simpler, and more opinionated. It spells out a high-level
sequence for setting up Teleport, then provides a list of advanced
topics for further reading.
Links correspond to sidebar sections--as before, I wanted to describe
the topic of each sidebar section so users would know this information
without having to navigate away from the landing page.
* Move the "Dynamic Configuration" section
Make this a subsection of "Manage your Cluster" since it's not
self-evidently clear as a top-level docs section. Users will probably
need an introduction via the "Manage your Cluster" section intro page.
This also reverts some of the more drastic sidebar changes introduced by
the previous commit.
Responds to xinding33 feedback.
* Make IAC learning tracks prominent/hard to avoid
Closes#27751
Responds to xinding33 feedback
The motivation is to be more opinionated about the course that users
take through the docs. We currently recommend two tracks for
self-service users, i.e., the users expected to make use of the landing
page:
- Setting up a toy self-hosted Teleport cluster
- Setting up a Teleport Team/Enterprise Cloud cluster that can
eventually become production ready
By moving the "Get Started" guide to the landing page, we direct users
immediately on to the first track. This change then gives new users a
way to enter the second track from the docs landing page with a
prominent link to the Teleport Team docs.
This change also edits The landing page to direct users who have
completed the getting started experience to instructions for setting up
a pool of agents on Terraform, helping to make infrastructure-as-code a
first-class citizen of the docs.
This change also removes the menu of links that used to confront users
on the landing page. Since all sidebar sections include introduction
pages, users interested in the content of a sidebar section can visit
the section. By removing links, we make it clearer for users how to
proceed through the docs.
* Fix linter errors
* Incorporate Trivy recommendations
* Respond to alexfornuto feedback
* Restore list of dynamic resources to the reference
* Fix linter warnings
* Remove the ".sh" extension from userdata script
The Terraform module that reads this file does not need the extension,
which was causing trouble for our shellcheck linter.
Paul Gottschling