mirror of https://github.com/gravitational/teleport.git synced 2026-11-01 13:39:37 +08:00

Files

T

Marco André Dinis cbdd842cce Install script for database agents (#17653 )

In the context of Discover, we want to ease the installation process of Teleport.

Our current focus is Databases.

Adding a database resource requires at least one Database service/agent running with matching labels for that resource.

The focus of this PR is to ease the installation of those agents.

Those service/agents are currently installed in a multi step flow:
- install Teleport on the host (select OS/arch/distribution format)
- configure the service by running `teleport configure db ...`
- start the application (possibly configuring the systemd unit file.

As you can see, this is a lot of steps.

This PR adds a new installation script: install-database.sh
This script is actually the same used for installing Server Nodes or App Service/Agents but now can also install database service/agents.

So, how does the new flow look like?
After adding the Database info (type, hostname, port and labels), and if there's no agent available, a new step appears: add a database agent.
The user provides a list of labels they want the agent to monitor.
Those labels are stored as SuggestedAgentMatcherLabels within the token which is generate after confirming the labels.

The user then gets an URL which they can use to install the agent.
This URL contains the token and when invoked creates the install-database.sh script containing the `db_service` configuration.
The field `db_service.resources.0.labels` contains the previously defined labels.
This script is almost the same that exists today for installing Server Nodes and App services/agents, it only changes the `teleport.yaml` configuration.

When the user run this command, the UI gets notified and can then proceed to the next step.


**Demo**

```bash
root@marcoacme-node-001:/shared# install-database.sh
2022-10-20 16:56:27 UTC [teleport-installer] TELEPORT_VERSION: 11.0.0-rc.1
2022-10-20 16:56:27 UTC [teleport-installer] TARGET_HOSTNAME: 127.0.0.1.nip.io
2022-10-20 16:56:27 UTC [teleport-installer] TARGET_PORT: 3080
2022-10-20 16:56:27 UTC [teleport-installer] JOIN_TOKEN: 6417b719b68d979ac01d3039f4246ce3
2022-10-20 16:56:27 UTC [teleport-installer] CA_PIN_HASHES: sha256:9fa22af321476074164f40aa901e291df92f3dbeea1b1f641bc5bf47efd00174
2022-10-20 16:56:27 UTC [teleport-installer] Checking TCP connectivity to Teleport server (127.0.0.1.nip.io:3080)
2022-10-20 16:56:27 UTC [teleport-installer] Couldn't find nc, telnet or /dev/tcp to do a connection test
2022-10-20 16:56:27 UTC [teleport-installer] Going to blindly continue without testing connectivity
2022-10-20 16:56:27 UTC [teleport-installer] Detected host: linux-gnu, using Teleport binary type linux
2022-10-20 16:56:27 UTC [teleport-installer] Detected arch: x86_64, using Teleport arch amd64
2022-10-20 16:56:27 UTC [teleport-installer] Detected distro type: debian
2022-10-20 16:56:27 UTC [teleport-installer] Using Teleport distribution: deb
2022-10-20 16:56:27 UTC [teleport-installer] Created temp dir /tmp/teleport-PWn6zEcG9P
2022-10-20 16:56:27 UTC [teleport-installer] Downloading Teleport deb release 11.0.0-rc.1
2022-10-20 16:56:27 UTC [teleport-installer] Running curl -fsSL --retry 5 --retry-delay 5 https://get.gravitational.com/teleport_11.0.0-rc.1_amd64.deb
2022-10-20 16:56:27 UTC [teleport-installer] Downloading to /tmp/teleport-PWn6zEcG9P/teleport_11.0.0-rc.1_amd64.deb
2022-10-20 16:56:50 UTC [teleport-installer] Downloaded file size: 119220326 bytes
2022-10-20 16:56:50 UTC [teleport-installer] Will use sha256sum to validate the checksum of the downloaded file
2022-10-20 16:56:52 UTC [teleport-installer] The downloaded file's checksum validated correctly
2022-10-20 16:56:52 UTC [teleport-installer] Using dpkg to install /tmp/teleport-PWn6zEcG9P/teleport_11.0.0-rc.1_amd64.deb
Selecting previously unselected package teleport.
(Reading database ... 8182 files and directories currently installed.)
Preparing to unpack .../teleport_11.0.0-rc.1_amd64.deb ...
Unpacking teleport (11.0.0-rc.1) ...
Setting up teleport (11.0.0-rc.1) ...
2022-10-20 16:56:54 UTC [teleport-installer] Found: Teleport v11.0.0-rc.1 git:v11.0.0-rc.1-0-g6950d74 go1.19.2
2022-10-20 16:56:54 UTC [teleport-installer] Writing Teleport database service config to /etc/teleport.yaml
2022-10-20 16:56:54 UTC [teleport-installer] Host does not appear to be using systemd
2022-10-20 16:56:54 UTC [teleport-installer] ---> This host is not running systemd, so Teleport cannot be started automatically when it exits.
2022-10-20 16:56:54 UTC [teleport-installer] ---> Please investigate an alternative way to keep Teleport running.
2022-10-20 16:56:54 UTC [teleport-installer] ---> You can find information in our documentation: https://goteleport.com/docs/
2022-10-20 16:56:54 UTC [teleport-installer] ---> For now, Teleport will be started in the foreground - you can press Ctrl+C to exit.

Run this command to start Teleport in future:
/usr/local/bin/teleport start --config=/etc/teleport.yaml

------------------------------------------------------------------------
| IMPORTANT: TELEPORT WILL STOP RUNNING AFTER YOU CLOSE THIS TERMINAL! |
|   YOU MUST CONFIGURE A SERVICE MANAGER TO MAKE IT RUN ON STARTUP!    |
------------------------------------------------------------------------

2022-10-20 16:56:54 UTC [teleport-installer] Starting Teleport in the foreground
2022-10-20T16:56:54Z             INFO Starting Teleport v11.0.0-rc.1 common/teleport.go:435
2022-10-20T16:56:54Z [PROC:1]    INFO Generating new host UUID: 51b404d7-e501-43f1-83dc-8298c1fcab2b. pid:379.1 service/service.go:874
2022-10-20T16:56:54Z [PROC:1]    INFO Joining the cluster with a secure token. pid:379.1 service/connect.go:582
2022-10-20T16:56:54Z [PROC:1]    INFO Joining the cluster with a secure token. pid:379.1 service/connect.go:582
2022-10-20T16:56:55Z [AUTH]      INFO Attempting registration via proxy server. auth/register.go:239
2022-10-20T16:56:55Z [AUTH]      INFO Attempting registration via proxy server. auth/register.go:239
...
root@marcoacme-node-001:/shared# cat /etc/teleport.yaml 
version: v3
teleport:
  nodename: marcoacme-node-001
  auth_token: 6417b719b68d979ac01d3039f4246ce3
  ca_pin:
  - sha256:9fa22af321476074164f40aa901e291df92f3dbeea1b1f641bc5bf47efd00174
  proxy_server: 127.0.0.1.nip.io:3080
  log:
    output: stderr
    severity: INFO
auth_service:
  enabled: no
ssh_service:
  enabled: no
proxy_service:
  enabled: no
db_service:
  enabled: "yes"
  resources:
    - labels:
        dev: prod
```

**Tech Details**
Request to create token with `suggested_agent_matcher_labels`:
```shell
curl 'https://127.0.0.1.nip.io:3080/v1/webapi/token' \
                     -H 'accept: application/json' \
                     -H 'content-type: application/json; charset=utf-8' \
                     --data-raw '
{
  "roles":["Db"],
  "join_method":"token",
  "allow":[],
  "suggested_agent_matcher_labels": {"dev":"prod"}
}
'
```

Closes #17446

2022-11-04 11:11:49 +00:00

install.sh

Install script for database agents (#17653 )

2022-11-04 11:11:49 +00:00

README.md

Introduce config v3, add auth_server and proxy_server, remove auth_addresses (#15761 )

2022-09-28 15:30:15 +00:00

README.md

Automated node join script for Teleport

This is an automated node join script for Teleport, which does the following:

checks for an existing Teleport process, data directory, config file or Teleport binaries (and provides details how to clean up if any of these are present)
tests connectivity to the given Teleport server host and port
- using either nc, telnet or /dev/tcp if available - if none of these are available this step is skipped
detects OS, distribution, architecture and appropriate Teleport package format, then downloads this package to a temporary directory and installs it
- tar for tarball extraction if needed
- dpkg for .deb installs
- dnf, yum or rpm for .rpm installs
generates a Teleport config to set up a node and writes it to disk
installs and starts Teleport
- via systemd on Linux
- via launchctl on MacOS
cleans up downloaded archives afterwards

Things it doesn't do (yet):

validate the checksum of the downloaded Teleport artifact against the published checksum

Supported operating systems, architectures and distributions

Linux
- Architectures
  - i386
  - x86_64
  - armv7l
  - aarch64 (no Teleport binaries available yet)
- Any Debian-based distribution
  - Debian 8+
  - Ubuntu 18.04+
    - uses .deb package
- Any CentOS-based distribution
  - CentOS 6+*
  - RHEL 6+*
    - CentOS 6 and RHEL 6 will use the special centos6 tarball package to handle the lower glibc version.
  - Fedora 27+
  - Amazon Linux 2+
    - uses .rpm package
- Any other distribution
  - uses .tar.gz tarball package
MacOS
- Architectures
  - x86_64
  - aarch64 (no Teleport binaries available yet)
- MacOS 10.12+
  - uses .tar.gz tarball package

Arguments

Required arguments:

Flag	Description	Example value	Required
`-v`	Teleport version	`4.3.5`	yes
`-h`	Hostname for the Teleport Proxy Service	`teleport.example.com`	yes
`-j`	A valid node join token	`ool7ahpo4thohmeuS1gieY7laiwae7oo`	yes
`-c`	The CA pin hash of the cluster being joined	`sha256:6abdd3a143a230fd31c9706d668bba3ee25a6e0eec54fcd69680c1ec0530fe9c`	yes
`-p`	Port connect to on the Teleport Proxy Service	`3080`	no

If any of these arguments is not provided via CLI flags, they will be requested interactively at runtime.

Optional extra flags:

Flag	Description	Example value	Required
`-q`	Enable quiet mode	n/a	no
`-l`	Write logs to file	`/var/log/teleport-node-installer.log`	no

Example usage

$ bash ./install.sh \
    -j ool7ahpo4thohmeuS1gieY7laiwae7oo \
    -c sha256:6abdd3a143a230fd31c9706d668bba3ee25a6e0eec54fcd69680c1ec0530fe9c \
    -h teleport.example.com \
    -p 3080 \
    -v 4.3.5