mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-16 16:39:53 +08:00
153 lines
3.9 KiB
Plaintext
153 lines
3.9 KiB
Plaintext
---
|
|
title: Application Access Reference Documentation
|
|
description: Configuration and CLI reference documentation for Teleport Application Access.
|
|
---
|
|
|
|
## Configuration
|
|
|
|
(!docs/pages/includes/backup-warning.mdx!)
|
|
|
|
The following snippet shows the full YAML configuration of an Application Service
|
|
appearing in the `teleport.yaml` configuration file:
|
|
|
|
```yaml
|
|
app_service:
|
|
# Enables application proxy service.
|
|
enabled: yes
|
|
# Enable debug app that can be used to make sure application access is
|
|
# working correctly. It'll output JWTs so it can be useful for when
|
|
# extending your application.
|
|
debug_app: true
|
|
# Matchers for application resources created with "tctl create" command.
|
|
resources:
|
|
- labels:
|
|
"*": "*"
|
|
# This section contains definitions of all applications proxied by this
|
|
# service. It can contain multiple items.
|
|
apps:
|
|
# Name of the application. Used for identification purposes.
|
|
- name: "grafana"
|
|
# Free-form application description.
|
|
description: "This is an internal Grafana instance"
|
|
# URI and port the application is available at.
|
|
uri: "http://localhost:3000"
|
|
# Optional application public address to override.
|
|
public_addr: "grafana.teleport.example.com"
|
|
# Rewrites section.
|
|
rewrite:
|
|
# Rewrite the "Location" header on redirect responses replacing the
|
|
# host with the public address of this application.
|
|
redirect:
|
|
- "grafana.internal.dev"
|
|
# Headers passthrough configuration.
|
|
headers:
|
|
- "X-Custom-Header: example"
|
|
- "X-External-Trait: {{external.env}}"
|
|
# Disable application certificate validation.
|
|
insecure_skip_verify: true
|
|
# Optional static labels to assign to the app. Used in RBAC.
|
|
labels:
|
|
env: "prod"
|
|
# Optional dynamic labels to assign to the app. Used in RBAC.
|
|
commands:
|
|
- name: "hostname"
|
|
command: ["hostname"]
|
|
period: 1m0s
|
|
```
|
|
|
|
## Application resource
|
|
|
|
Full YAML spec of application resources managed by `tctl` resource commands:
|
|
|
|
```yaml
|
|
kind: app
|
|
version: v3
|
|
metadata:
|
|
# Application name.
|
|
name: example
|
|
# Application description.
|
|
description: "Example application"
|
|
# Application static labels.
|
|
labels:
|
|
env: local
|
|
spec:
|
|
# URI and port application is available at.
|
|
uri: http://localhost:4321
|
|
# Optional application public address.
|
|
public_addr: test.example.com
|
|
# Disable application certificate validation.
|
|
insecure_skip_verify: true
|
|
# Rewrites configuration.
|
|
rewrite:
|
|
# Rewrite the "Location" header on redirect responses replacing the
|
|
# host with the public address of this application.
|
|
redirect:
|
|
- "grafana.internal.dev"
|
|
# Headers passthrough configuration.
|
|
headers:
|
|
- "X-Custom-Header: example"
|
|
- "X-External-Trait: {{external.env}}"
|
|
# Optional dynamic labels.
|
|
dynamic_labels:
|
|
- name: "hostname"
|
|
command: ["hostname"]
|
|
period: 1m0s
|
|
```
|
|
|
|
## CLI
|
|
|
|
This section shows CLI commands relevant for Application Access.
|
|
|
|
### tsh app ls
|
|
|
|
Lists available applications.
|
|
|
|
```code
|
|
$ tsh app ls
|
|
```
|
|
|
|
### tsh app login
|
|
|
|
Retrieves short-lived X.509 certificate for CLI application access.
|
|
|
|
```code
|
|
$ tsh app login grafana
|
|
```
|
|
|
|
### tsh app logout
|
|
|
|
Removes CLI application access certificate.
|
|
|
|
```code
|
|
# Log out of a particular app.
|
|
$ tsh app logout grafana
|
|
|
|
# Log out of all apps.
|
|
$ tsh app logout
|
|
```
|
|
|
|
### tsh app config
|
|
|
|
Prints application connection information.
|
|
|
|
```code
|
|
# Print app information in a table form.
|
|
$ tsh app config
|
|
|
|
# Print information for a particular app.
|
|
$ tsh app config grafana
|
|
|
|
# Print an example curl command.
|
|
$ tsh app config --format=curl
|
|
|
|
# Construct a curl command.
|
|
$ curl $(tsh app config --format=uri) \
|
|
--cacert $(tsh app config --format=ca) \
|
|
--cert $(tsh app config --format=cert) \
|
|
--key $(tsh app config --format=key)
|
|
```
|
|
|
|
| Flag | Description |
|
|
| - | - |
|
|
| `--format` | Optional print format, one of: `uri` to print app address, `ca` to print CA cert path, `cert` to print cert path, `key` print key path, `curl` to print example curl command.|
|