teleport

mirror of https://github.com/gravitational/teleport.git synced 2026-09-24 16:17:11 +08:00

Files

T

Zac Bergquist 33622b1eb7 Complete empty uploads

The upload completer scans for uploads that need to be completed,
likely due to an error or process restart. Prior to this change,
it only completed uploads that had 1 or more parts. Since completing
an upload is what cleans up the directory on disk (or in the case of
cloud storage, finishes the multipart upload), it was possible
for us to leave behind empty directories (or multipart uploads)
for uploads with no parts.

This change makes it valid to complete uploads with no parts, which
ensures that these directories get cleaned up.

Also fix an issue with the GCS uploader, which failed to properly calculate
the upload ID from the path. This is because strings.Split(s, "/") returns an empty
string as the last element when s ends with a /.

Updates #9646

2022-03-03 08:26:44 -07:00

doc.go

Lint and fix missing license headers (#8075 )

2021-08-30 09:44:09 -07:00

gcshandler_test.go

use google/uuid instead of pborman/uuid (#9793 )

2022-01-19 23:44:48 +00:00

gcshandler.go

Update google.golang.org/grpc to v1.43.0 (#9656 )

2022-01-10 15:36:50 -05:00

gcsstream_test.go

Complete empty uploads

2022-03-03 08:26:44 -07:00

gcsstream.go

Complete empty uploads

2022-03-03 08:26:44 -07:00

README.md

adds support for GCP HA environments with gcs recording storage, firestore-backed events, and firestore backend storage

2019-09-05 13:09:55 -07:00

README.md

GCS Storage Implementation for Teleport

Introduction

This package enables Teleport auth server to store session recordings in GCS on GCP.

WARNING: Using GCS involves recurring charge from GCP.

Building

GCS session storage is not enabled by default. To enable it you have to compile Teleport with gcs build flag.

To build Teleport with GCS enabled, run:

ADDFLAGS='-tags gcs' make teleport

Quick Start

Configuration options are passed to the GCS handler via a URI/URL. The following is a sample configuration in teleport section of the config file (by default it's /etc/teleport.yaml):

teleport:
  storage:
    audit_sessions_uri: 'gs://teleport-session-storage-2?projectID=gcp-proj&credentialsPath=/var/lib/teleport/gcs_creds'

Full Properties

The full list of configurable properties for this backend are:

host portion of URI is the GCS bucket used to persist session recordings
credentialsPath (string, path to GCP creds for Firestore, not-required)
projectID (string, project ID, required)
endpoint (string, GCS client endpoint, not-required, ex: localhost:8618)
path (string, the path inside the GCS bucket to use as storage root, not-required)
keyName (string, the user-defined GCP KMS key name to use for encryption, not-required)

GCS Client Authentication Options

There are three authentication/authorization modes available;

With no credentialsPath and no endpoint defined, the GCS client will use Google Application Default Credentials for authentication. This only works in cases where Teleport is installed on GCE instances and have service accounts with IAM role/profile associations authorizing that GCE instance to use Firestore.
With endpoint defined, GCS will create a client with no auth and clients pointed at the specified endpoint. This is only used for tests, see Tests section below.
With credentialsPath defined, Firestore will create clients authenticating against live systems with the Service Account bound to the JSON key file referenced in the option.

Get Help

This backend has been contributed by https://github.com/joshdurbin