mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-03 07:40:28 +08:00
Paul Gottschling
9d7b2209b0
Closes #44532 Ensure that all docs pages include an introductory paragraph, which spells out the scope of a page and indicates to a reader whether the page is appropriate for their needs. In some pages, the "How it works" section functions like an introductory paragraph. In these cases, turn the "How it works" section into an introductory paragraph and add a new "How it works" section. Other pages already include an introductory paragraph with the H2 "Introduction". Standardize the docs on not including a heading before the introductory paragraph.
80 lines
3.9 KiB
Plaintext
80 lines
3.9 KiB
Plaintext
---
|
|
title: Database Labels Reference
|
|
description: Database labels reference for Teleport database access.
|
|
---
|
|
|
|
Teleport assigns system-defined labels to protected databases. This guide
|
|
describes the system-defined labels and how Teleport uses them.
|
|
|
|
## Origin
|
|
|
|
All registered databases have a predefined `teleport.dev/origin` label with one
|
|
of the following values:
|
|
|
|
| Label Value | Description |
|
|
| - | - |
|
|
| `cloud` | database resources created by auto-discovery. |
|
|
| `config` | database resources manually defined in the `database_service.databases` section of `teleport.yaml`. |
|
|
| `dynamic` | database resources created through [dynamic registration](../../../enroll-resources/database-access/guides/dynamic-registration.mdx) like `tcl create` command. |
|
|
|
|
## Auto-discovery
|
|
|
|
The labels of auto-discovered databases primarily come from the tags that are
|
|
assigned to the original cloud resources, such as the resources tags of an
|
|
Amazon RDS instance.
|
|
|
|
The following tags will override Teleport's default behavior if assigned to the
|
|
original cloud resources:
|
|
|
|
| Tag name | Description |
|
|
| - | - |
|
|
| `TeleportDatabaseName` | Overrides the name of the discovered database. |
|
|
| `teleport.dev/database_name` | (AWS only, legacy) Overrides the name of the discovered database. `TeleportDatabaseName` is preferred. |
|
|
| `teleport.dev/db-admin` | (AWS only) Specifies the name of the admin user for Automatic User Provisioning. |
|
|
| `teleport.dev/db-admin-default-database` | (AWS only) Overrides the default database the admin user logs into for Automatic User Provisioning. |
|
|
|
|
Additionally, Teleport will generate certain labels derived from the cloud
|
|
resource attributes:
|
|
|
|
| Label name | Description |
|
|
| - | - |
|
|
| `account-id` | ID of the AWS account the resource resides in. |
|
|
| `endpoint-type` | Type of the endpoint. See section below for more details. |
|
|
| `engine` | Amazon RDS: engine type of the RDS instance or Aurora cluster.<br/>Amazon RDS Proxy: engine family of the proxy.<br/>Azure-hosted databases: resource type of the resource ID. |
|
|
| `engine-version` | Database engine version, if available. |
|
|
| `namespace` | Amazon Redshift Serverless namespace name. |
|
|
| `region` | AWS region or Azure location. |
|
|
| `replication-role` | The replication role of an Azure DB Flexible server. |
|
|
| `source-server` | The source server of an Azure DB Flexible server replica. |
|
|
| `vpc-id` | ID of the Amazon VPC the resource resides in, if available. |
|
|
| `workgroup` | Amazon Redshift Serverless workgroup name. |
|
|
| `teleport.dev/discovery-type` | Specifies the type of resource matched by the Teleport Discovery Service, e.g. "rds", "redshift", etc. |
|
|
|
|
### `endpoint-type`
|
|
|
|
The following values are used to indicate the type of the database endpoint:
|
|
|
|
| Database Type | Values |
|
|
| - | - |
|
|
| Amazon RDS instance | `instance` |
|
|
| Amazon RDS Aurora cluster | one of `primary`, `reader`, `custom` |
|
|
| Amazon RDS Proxy | one of `READ_WRITE`, `READ_ONLY` (custom endpoints only) |
|
|
| Amazon Redshift Serverless | one of `workgroup`, `vpc-endpoint` |
|
|
| Amazon ElastiCache | one of `configuration`, `primary`, `reader`, `node` |
|
|
| Amazon MemoryDB | one of `cluster`, `node` |
|
|
| Amazon OpenSearch | one of `default`, `custom`, `vpc` |
|
|
| Azure Redis Enterprise | one of `EnterpriseCluster`, `OSSCluster` |
|
|
|
|
## Manual and dynamic registration
|
|
|
|
Static labels and dynamic labels can be specified in `labels` and
|
|
`dynamic_labels` fields respectively in database definition. See
|
|
[Configuration](./configuration.mdx) for reference.
|
|
|
|
## Database Service on Amazon EC2
|
|
|
|
All registered databases can inherit the labels converted from the tags of the
|
|
EC2 instance running the Teleport Database Service. Labels created this way
|
|
will have the `aws/` prefix. See [Sync EC2
|
|
Tags](../../../admin-guides/management/guides/ec2-tags.mdx) for more details.
|