mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-02 14:59:53 +08:00
Hugo ShakaandPaul Gottschling
920495c6d7
Provides a solution for #9298 This removes an unnecessary limitation of the Helm chart: `.Values.tls.existingCASecretName` can now be used without `.Values.tls.existingSecretName`. This allows users to trust their own CAs without building custom images. Context: - go's x509 library supports loading system certs based on the SSL_CERTS_FILE environment variable - we are already using this in the chart to trust private CAs (teleport proxy needs to trust its own certs to start) - users might want to trust custom CAs to - speak with a S3 backend (minio) - validate upstream app certs (unlike DB access you can't trust certs per-application) - trust another cluster - call an OIDC provider - teleport-kube-agent chart already has the feature Co-authored-by: Paul Gottschling <paul.gottschling@goteleport.com>
Examples
Configuration Examples
- local-cluster : Sample configuration of a 3-node Teleport cluster using just a single machine
Daemon Configuration
AWS examples
- AWS: CloudFormation : CloudFormation templates as an example of how to setup HA Teleport in AWS using our AMIs.
- AWS: Terraform : Terraform specifies example provisioning script for Teleport auth, proxy and nodes in HA mode.
- AWS: EKS. External Link
Kubernetes - Helm Charts
- Helm Chart - Teleport Enterprise : For deploying into Kubernetes using Helm
- Helm Chart - Teleport Demo : An internal demo app showing Teleport components deployed into Kubernetes using Helm Charts.
SSO Connector Examples and Trusted Cluster Examples
SSO Resources
- Active Directory - YAML Resource
- OIDC Connector, like "keycloak". - YAML Resource
- SAML Connector, like "Okta". - YAML Resource