mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 19:12:46 +08:00
92 lines
2.9 KiB
Plaintext
92 lines
2.9 KiB
Plaintext
In order to allow your GitHub Actions workflow to authenticate with your
|
|
Teleport cluster, you'll first need to create a join token. These tokens set out
|
|
criteria by which the Auth Server decides whether or not to allow a bot or node
|
|
to join.
|
|
|
|
To create a token, we can write the resource's YAML to a file on disk, and then
|
|
use `tctl` to apply it.
|
|
|
|
Create a file named `tokenconfig.yaml` and insert the following contents:
|
|
|
|
<Tabs>
|
|
<TabItem label="GitHub">
|
|
|
|
```yaml
|
|
kind: token
|
|
version: v2
|
|
metadata:
|
|
name: github-token
|
|
spec:
|
|
roles: [Bot]
|
|
join_method: github
|
|
bot_name: github-demo
|
|
github:
|
|
allow:
|
|
- repository: gravitational/example
|
|
```
|
|
|
|
</TabItem>
|
|
<TabItem label="GitHub Enterprise Server">
|
|
From Teleport 11.1.4, users with Teleport Enterprise are able to permit
|
|
workflows within GitHub Enterprise Server instances to authenticate using the
|
|
GitHub join method.
|
|
|
|
This is configured by an additional `enterprise_server_host` field in the Token
|
|
resource. This should be set to the host of your GHES instance.
|
|
|
|
```yaml
|
|
kind: token
|
|
version: v2
|
|
metadata:
|
|
name: github-token
|
|
spec:
|
|
roles: [Bot]
|
|
join_method: github
|
|
bot_name: github-demo
|
|
github:
|
|
enterprise_server_host: your.ghes.instance.example.com
|
|
allow:
|
|
- repository: gravitational/example
|
|
```
|
|
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
Let's go over the token resource YAML's fields in more detail:
|
|
|
|
- `metadata.name` defines the name of the token. Note that this value will need
|
|
to be used in other parts of the configuration later.
|
|
- `metadata.expires` defines the date that the join token will expire. This
|
|
example is set to the year `2100`.
|
|
- `spec.bot_name` is the name of the Machine ID bot that this token will grant
|
|
access to. Note that this value will need to be used in other parts of the
|
|
configuration later.
|
|
- `spec.roles` defines which roles that this token will grant access to. The
|
|
value of `[Bot]` states that this token grants access to a Machine ID bot.
|
|
- `spec.join_method` defines the join method the token is applicable for. Since
|
|
this guide only focuses on GitHub Actions, we will set this to to `github`.
|
|
- `spec.github.allow` is used to set rules for what GitHub Actions will be able
|
|
to authenticate by using the token. In this example, the `gravitational/example`
|
|
repository is used, and this example repository should be replaced with your own
|
|
repo.
|
|
|
|
You can find a full list of the token configuration options for GitHub Actions
|
|
joining on the
|
|
[GitHub Actions reference page.](../../machine-id/reference/github-actions.mdx#github-join-token)
|
|
|
|
Once the resource file has been written, create the token with `tctl`:
|
|
|
|
```code
|
|
$ tctl create -f tokenconfig.yaml
|
|
```
|
|
|
|
Check that token `github-token` has been created with the following
|
|
command:
|
|
|
|
```code
|
|
$ tctl tokens ls
|
|
Token Type Labels Expiry Time (UTC)
|
|
----------- ---- ------ ----------------------------------------------
|
|
github-token Bot 01 Jan 00 00:00 UTC (2562047h47m16.854775807s)
|
|
```
|