gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-12 02:15:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

MWI Docs: Tidy/rearrange reference section (#60870)

Browse Source 
* Remove/replace github actions/gitlab reference pages

* Promote content from machine-id subdir to parent directory

* Fix links

* Avoid usage of the term "Machine ID"

* Fix redirects

* fix backlinks

* Fix more backlinks

* Fix more backlinks

* Fix even more backlinks

* Fix one last link

* Fix old redirects

* Fix a few more redirects
This commit is contained in:
Noah Stride
2025-11-03 16:41:49 +00:00
committed by GitHub
parent 2c8f4bb947
commit d92e2cb6ec
59 changed files with 238 additions and 325 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+2 -3
View File
@@ -185,8 +185,7 @@ Support for disabling multi-factor authentication has been removed
Users with custom `ssh_config` should modify their ProxyCommand to use the new,
more performant, `tbot ssh-proxy-command`. See the
[v16 upgrade guide](docs/pages/reference/machine-workload-identity/machine-id/v16-upgrade-guide.mdx) for
more details.
v16 upgrade guide for more details.
#### Default keyboard shortcuts in Teleport Connect have been changed
@@ -602,7 +601,7 @@ In Teleport 14, `tbot` can now be configured to write artifacts such as
credentials and configuration files directly to a Kubernetes secret rather than
a directory on the local file system.
For more information, see [docs](docs/pages/reference/machine-workload-identity/machine-id/configuration.mdx).
For more information, see [docs](docs/pages/reference/machine-workload-identity/configuration.mdx).
### Breaking changes and deprecations
docs/config.json
+74 -14
View File
@@ -222,12 +222,12 @@
},
{
"source": "/machine-id/reference/telemetry/",
"destination": "/reference/machine-workload-identity/machine-id/telemetry/",
"destination": "/reference/machine-workload-identity/telemetry/",
"permanent": true
},
{
"source": "/machine-id/reference/v16-upgrade-guide/",
"destination": "/reference/machine-workload-identity/machine-id/v16-upgrade-guide/",
"destination": "/reference/machine-workload-identity/",
"permanent": true
},
{
@@ -752,7 +752,7 @@
},
{
"source": "/machine-workload-identity/machine-id/deployment/bound-keypair/",
"destination": "/reference/machine-workload-identity/machine-id/bound-keypair/getting-started/",
"destination": "/reference/machine-workload-identity/bound-keypair/getting-started/",
"permanent": true
},
{
@@ -770,6 +770,66 @@
"destination": "/machine-workload-identity/mwi-ci-cd/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/gitlab/",
"destination": "/reference/deployment/join-methods/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/github-actions/",
"destination": "/reference/deployment/join-methods/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/",
"destination": "/reference/machine-workload-identity/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/configuration/",
"destination": "/reference/machine-workload-identity/configuration/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/diagnostics-service/",
"destination": "/reference/machine-workload-identity/diagnostics-service/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/telemetry/",
"destination": "/reference/machine-workload-identity/telemetry/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/bound-keypair/admin-guide/",
"destination": "/reference/machine-workload-identity/bound-keypair/admin-guide/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/bound-keypair/",
"destination": "/reference/machine-workload-identity/bound-keypair/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/bound-keypair/concepts/",
"destination": "/reference/machine-workload-identity/bound-keypair/concepts/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/bound-keypair/getting-started/",
"destination": "/reference/machine-workload-identity/bound-keypair/getting-started/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/bound-keypair/static-keys/",
"destination": "/reference/machine-workload-identity/bound-keypair/static-keys/",
"permanent": true
},
{
"source": "/reference/machine-workload-identity/machine-id/v16-upgrade-guide/",
"destination": "/reference/machine-workload-identity/",
"permanent": true
},
{
"source": "/admin-guides/deploy-a-cluster/access-graph/",
"destination": "/identity-security/access-graph/",
@@ -1717,57 +1777,57 @@
},
{
"source": "/reference/machine-id/bound-keypair/admin-guide/",
"destination": "/reference/machine-workload-identity/machine-id/bound-keypair/admin-guide/",
"destination": "/reference/machine-workload-identity/bound-keypair/admin-guide/",
"permanent": true
},
{
"source": "/reference/machine-id/bound-keypair/",
"destination": "/reference/machine-workload-identity/machine-id/bound-keypair/",
"destination": "/reference/machine-workload-identity/bound-keypair/",
"permanent": true
},
{
"source": "/reference/machine-id/bound-keypair/concepts/",
"destination": "/reference/machine-workload-identity/machine-id/bound-keypair/concepts/",
"destination": "/reference/machine-workload-identity/bound-keypair/concepts/",
"permanent": true
},
{
"source": "/reference/machine-id/bound-keypair/getting-started/",
"destination": "/reference/machine-workload-identity/machine-id/bound-keypair/getting-started/",
"destination": "/reference/machine-workload-identity/bound-keypair/getting-started/",
"permanent": true
},
{
"source": "/reference/machine-id/configuration/",
"destination": "/reference/machine-workload-identity/machine-id/configuration/",
"destination": "/reference/machine-workload-identity/configuration/",
"permanent": true
},
{
"source": "/reference/machine-id/diagnostics-service/",
"destination": "/reference/machine-workload-identity/machine-id/diagnostics-service/",
"destination": "/reference/machine-workload-identity/diagnostics-service/",
"permanent": true
},
{
"source": "/reference/machine-id/github-actions/",
"destination": "/reference/machine-workload-identity/machine-id/github-actions/",
"destination": "/reference/deployment/join-methods/",
"permanent": true
},
{
"source": "/reference/machine-id/gitlab/",
"destination": "/reference/machine-workload-identity/machine-id/gitlab/",
"destination": "/reference/deployment/join-methods/",
"permanent": true
},
{
"source": "/reference/machine-id/",
"destination": "/reference/machine-workload-identity/machine-id/",
"destination": "/reference/machine-workload-identity/",
"permanent": true
},
{
"source": "/reference/machine-id/telemetry/",
"destination": "/reference/machine-workload-identity/machine-id/telemetry/",
"destination": "/reference/machine-workload-identity/telemetry/",
"permanent": true
},
{
"source": "/reference/machine-id/v16-upgrade-guide/",
"destination": "/reference/machine-workload-identity/machine-id/v16-upgrade-guide/",
"destination": "/reference/machine-workload-identity/",
"permanent": true
},
{
docs/pages/machine-workload-identity/getting-started.mdx
+2 -2
View File
@@ -267,7 +267,7 @@ $ tctl create -f join_token.yaml
## Step 5/5 Access a resource from GitHub Actions
We have several published [Actions](../reference/machine-workload-identity/machine-id/github-actions.mdx#github-actions-helpers)
We have several published [Actions](../reference/deployment/join-methods.mdx#github-actions-helpers)
for convenience, but for this guide we will look at things explicitly to aid understanding.
Within your GitHub repository, you'll create two different files:
@@ -471,7 +471,7 @@ without distributing long-lived credentials, making the process more secure and
configuring `tbot` in a production-ready way for your platform.
- Check out the [access guides](./machine-id/access-guides/access-guides.mdx) to learn about configuring
`tbot` for other use cases than SSH and Kubernetes.
- Read the [configuration reference](../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- Learn how [Workload Identities](../machine-workload-identity/workload-identity/introduction.mdx) enable the same capabilities
for resources like cloud APIs that can't be protected with the Teleport proxy.
docs/pages/machine-workload-identity/machine-id/access-guides/ansible-awx.mdx
+3 -3
View File
@@ -196,7 +196,7 @@ data:
```
For more information on the possible values in this config file, see Machine
ID's [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx).
ID's [configuration reference](../../../reference/machine-workload-identity/configuration.mdx).
<Admonition type="info" title="About the ssh-multiplexer">
Machine ID's `ssh-multiplexer` service is used to improve performance when
@@ -205,7 +205,7 @@ opening many SSH connections. It provides a Unix socket which the
shared connection to Teleport. The SSH config written to
`/tbot-output/ssh_config` will be automatically configured to do this.
See the [reference page](../../../reference/machine-workload-identity/machine-id/configuration.mdx#ssh-multiplexer)
See the [reference page](../../../reference/machine-workload-identity/configuration.mdx#ssh-multiplexer)
to learn more about the `ssh-multiplexer` service.
</Admonition>
@@ -501,7 +501,7 @@ We've configured the `tbot` client to provide its own multiplexer (via the
## Next Steps
- Learn more about [deploying Machine ID in Kubernetes](../deployment/kubernetes.mdx)
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
{/* see also: https://github.com/ansible/awx-logos/blob/master/TRADEMARKS.md */}
docs/pages/machine-workload-identity/machine-id/access-guides/ansible.mdx
+1 -1
View File
@@ -274,7 +274,7 @@ spec:
## Next steps
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- If you use Ansible AWX or Ansible Automation Platform, read our
[dedicated Ansible AWX Guide](./ansible-awx.mdx).
docs/pages/machine-workload-identity/machine-id/access-guides/applications.mdx
+1 -1
View File
@@ -226,5 +226,5 @@ has been configured to use both the client certificate and key.
your bot may access.
- Configure [JWTs](../../../enroll-resources/application-access/jwt/introduction.mdx) for your
Application to remove the need for additional login credentials.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/machine-workload-identity/machine-id/access-guides/argocd.mdx
+1 -1
View File
@@ -334,7 +334,7 @@ groups.
## Next steps
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx)
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx)
to explore all the available configuration options.
- Read the [Teleport Kubernetes RBAC guide](../../../enroll-resources/kubernetes-access/controls.mdx)
for more details on controlling Kubernetes access.
docs/pages/machine-workload-identity/machine-id/access-guides/databases.mdx
+1 -1
View File
@@ -268,5 +268,5 @@ access controls.
## Next steps
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/machine-workload-identity/machine-id/access-guides/kubernetes.mdx
+1 -1
View File
@@ -209,7 +209,7 @@ this format is compatible with most Kubernetes tools including:
## Next steps
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- Read the [Teleport Kubernetes RBAC guide](../../../enroll-resources/kubernetes-access/controls.mdx)
for more details on controlling Kubernetes access.
docs/pages/machine-workload-identity/machine-id/access-guides/mcp.mdx
+1 -1
View File
@@ -207,5 +207,5 @@ MCP client you are using.
- Read the [MCP access documentation](../../../enroll-resources/mcp-access/mcp-access.mdx)
to learn more about Teleport's MCP integration and RBAC controls.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options for `tbot`.
docs/pages/machine-workload-identity/machine-id/access-guides/ssh.mdx
+1 -1
View File
@@ -172,5 +172,5 @@ SSH client certificates and either ProxyCommand or ProxyJump functionality.
## Next steps
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/machine-workload-identity/machine-id/access-guides/tctl.mdx
+1 -1
View File
@@ -149,5 +149,5 @@ $ tctl get role/tctl-test
- Explore the [`tctl` reference](../../../reference/cli/tctl.mdx) to discover all
`tctl` can do.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available `tbot` configuration options.
docs/pages/machine-workload-identity/machine-id/deployment/aws.mdx
+2 -2
View File
@@ -130,6 +130,6 @@ Replace:
- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/azure-devops.mdx
+2 -2
View File
@@ -198,6 +198,6 @@ exit.
[join method reference page.](../../../reference/deployment/join-methods.mdx#azure-devops-azure_devops)
- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/azure.mdx
+2 -2
View File
@@ -132,6 +132,6 @@ Replace:
- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/bitbucket.mdx
+1 -1
View File
@@ -158,7 +158,7 @@ credentials are needed in multiple steps.
- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- For more information about Bitbucket Pipelines itself, read
[their documentation](https://support.atlassian.com/bitbucket-cloud/docs/get-started-with-bitbucket-pipelines/).
docs/pages/machine-workload-identity/machine-id/deployment/circleci.mdx
+2 -2
View File
@@ -216,8 +216,8 @@ resources in your Teleport cluster that your CI/CD needs to interact with.
- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- For more information about CircleCI itself, read
[their documentation](https://circleci.com/docs/).
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/deployment.mdx
+4 -4
View File
@@ -46,7 +46,7 @@ Choose a guide based on the platform where you intend to run Machine ID.
If a specific guide does not exist for your platform, the [Linux
guide](linux.mdx) is compatible with most platforms. For
custom approaches, you can also read the [Machine ID Reference](../../../reference/machine-workload-identity/machine-id/machine-id.mdx)
custom approaches, you can also read the [Machine ID Reference](../../../reference/machine-workload-identity/machine-workload-identity.mdx)
and [Architecture](../../../reference/architecture/machine-id-architecture.mdx) to plan your deployment.
<TileGrid
@@ -113,7 +113,7 @@ and [Architecture](../../../reference/architecture/machine-id-architecture.mdx)
},
{
icon: <Icon name="lock" size="xl" />,
to: "../../../reference/machine-workload-identity/machine-id/bound-keypair/getting-started",
to: "../../../reference/machine-workload-identity/bound-keypair/getting-started",
name: "Bound Keypair Joining",
}
]}
@@ -167,7 +167,7 @@ Read the following guides for how to deploy Machine ID on a continuous integrati
},
{
icon: <Icon name="lock" size="xl" />,
to: "../../../reference/machine-workload-identity/machine-id/bound-keypair/static-keys",
to: "../../../reference/machine-workload-identity/bound-keypair/static-keys",
name: "Bound Keypair static keys (Generic)",
}
]}
@@ -178,4 +178,4 @@ If your CI/CD provider does not have a dedicated join method listed above,
consider using [Bound Keypair static keys][bound-keypair-static] as a fallback.
</Admonition>
[bound-keypair-static]: ../../../reference/machine-workload-identity/machine-id/bound-keypair/static-keys.mdx
[bound-keypair-static]: ../../../reference/machine-workload-identity/bound-keypair/static-keys.mdx
docs/pages/machine-workload-identity/machine-id/deployment/gcp.mdx
+2 -2
View File
@@ -133,6 +133,6 @@ Replace:
- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/github-actions.mdx
+4 -4
View File
@@ -43,7 +43,7 @@ GitHub Actions run within a specific GitHub repository. In production, you may
wish to further restrict these rules to ensure that access can only occur
when CI is running against a specific branch. You can find a full list of the
available rules on the
[GitHub Actions reference page.](../../../reference/machine-workload-identity/machine-id/github-actions.mdx)
[join token reference page.](../../../reference/deployment/join-methods.mdx#github-actions-github)
Create a file named `bot-token.yaml`:
@@ -452,9 +452,9 @@ interact with.
- [teleport-actions/auth](https://github.com/teleport-actions/auth)
- [teleport-actions/auth-k8s](https://github.com/teleport-actions/auth-k8s)
- [teleport-actions/auth-application](https://github.com/teleport-actions/auth-application)
- For more information about the `github` join method, read the [GitHub Actions
reference page](../../../reference/machine-workload-identity/machine-id/github-actions.mdx)
- For more information about the `github` join method, read the
[join token reference page](../../../reference/deployment/join-methods.mdx#github-actions-github)
- Find out more about GitHub Actions itself, read
[their documentation](https://docs.github.com/en/actions).
- [More information about `anonymous-telemetry`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `anonymous-telemetry`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/gitlab.mdx
+4 -4
View File
@@ -81,7 +81,7 @@ spec:
You can find a full list of the token configuration options for GitLab joining
on the
[GitLab CI reference page.](../../../reference/machine-workload-identity/machine-id/gitlab.mdx)
[join tokens reference page.](../../../reference/deployment/join-methods.mdx#gitlab-gitlab)
Apply this to your Teleport cluster using `tctl`:
@@ -175,11 +175,11 @@ failure.
## Further steps
- For more information about GitLab joining, read the
[GitLab CI reference page.](../../../reference/machine-workload-identity/machine-id/gitlab.mdx)
[join method reference page.](../../../reference/deployment/join-methods.mdx#gitlab-gitlab)
- For more information about GitLab itself, read
[their documentation](https://docs.gitlab.com/ee/ci/).
- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/jenkins.mdx
+1 -1
View File
@@ -178,5 +178,5 @@ to a machine identity that can be rotated, audited, and controlled with access c
## Next steps
[More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
[More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/kubernetes-oidc.mdx
+2 -2
View File
@@ -300,8 +300,8 @@ out more about how to configure `tbot` for your use case.
- Explore the [Helm chart configuration reference](../../../reference/helm-reference/tbot.mdx).
- Follow the [access guides](../access-guides/access-guides.mdx) to finish
configuring `tbot` for your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
[said]: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-issuer-discovery
docs/pages/machine-workload-identity/machine-id/deployment/kubernetes.mdx
+2 -2
View File
@@ -229,6 +229,6 @@ out more about how to configure `tbot` for your use case.
- Explore the [Helm chart configuration reference](../../../reference/helm-reference/tbot.mdx).
- Follow the [access guides](../access-guides/access-guides.mdx) to finish
configuring `tbot` for your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/linux-tpm.mdx
+2 -2
View File
@@ -207,6 +207,6 @@ $ sudo chown teleport:teleport /var/lib/teleport/bot
your environment.
- Read the [TPM joining reference](../../../reference/deployment/join-methods.mdx#trusted-platform-module-tpm)
to learn more about `tpm`joining.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/deployment/linux.mdx
+2 -2
View File
@@ -102,6 +102,6 @@ run has completed, but there is no tangible security benefit to doing so.
- Follow the [access guides](../access-guides/access-guides.mdx) to finish configuring `tbot` for
your environment.
- Read the [configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/machine-id/telemetry.mdx)
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../../../reference/machine-workload-identity/telemetry.mdx)
docs/pages/machine-workload-identity/machine-id/faq.mdx
+1 -1
View File
@@ -110,7 +110,7 @@ advantage of this functionality.
Refer to the
[CLI reference](../../reference/cli/tbot.mdx#tbot-start-kubernetesv2) and
[config reference](../../reference/machine-workload-identity/machine-id/configuration.mdx#kubernetesv2)
[config reference](../../reference/machine-workload-identity/configuration.mdx#kubernetesv2)
for more information.
## Does `tbot` support Windows?
docs/pages/machine-workload-identity/machine-id/introduction.mdx
+1 -1
View File
@@ -112,7 +112,7 @@ Production-ready guidance on deploying Machine ID is broken out into two parts:
them.
- [Architecture](../../reference/architecture/machine-id-architecture.mdx): A technical deep-dive into how Machine ID
works.
- [Reference](../../reference/machine-workload-identity/machine-id/machine-id.mdx): Complete documentation of available
- [Reference](../../reference/machine-workload-identity/machine-workload-identity.mdx): Complete documentation of available
configuration options.
- [Manifesto](./manifesto.mdx): Our vision for Machine Identity and the
direction Machine ID and Workload ID are heading in.
docs/pages/machine-workload-identity/mwi-ci-cd.mdx
+1 -1
View File
@@ -87,5 +87,5 @@ API endpoints and full audit visibility.
- [Architecture](../reference/architecture/machine-id-architecture.mdx): A technical deep-dive into how Machine ID
works.
- [Reference](../reference/machine-workload-identity/machine-id/machine-id.mdx): Complete documentation of available
- [Reference](../reference/machine-workload-identity/machine-workload-identity.mdx): Complete documentation of available
configuration options.
docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx
+1 -1
View File
@@ -490,5 +490,5 @@ Workload Identity.
Teleport Workload Identity.
- [Best Practices](./best-practices.mdx): Best practices for using Workload
Identity in Production.
- Read the [configuration reference](../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/machine-workload-identity/workload-identity/aws-roles-anywhere.mdx
+1 -1
View File
@@ -349,5 +349,5 @@ The official AWS documentation for Roles Anywhere.
Workload Identity.
- [Best Practices](./best-practices.mdx): Best practices for using Workload
Identity in Production.
- Read the [configuration reference](../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/machine-workload-identity/workload-identity/azure-federated-credentials.mdx
+1 -1
View File
@@ -343,5 +343,5 @@ Workload Identity.
Teleport Workload Identity.
- [Best Practices](./best-practices.mdx): Best practices for using Workload
Identity in Production.
- Read the [configuration reference](../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/machine-workload-identity/workload-identity/federation.mdx
+1 -1
View File
@@ -103,7 +103,7 @@ Workload API.
Workload Identity.
- [Best Practices](./best-practices.mdx): Best practices for using Workload
Identity in Production.
- Read the [configuration reference](../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
- Read the [SPIFFE Federation Specification](https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Federation.md)
to understand the technical details of SPIFFE Federation.
docs/pages/machine-workload-identity/workload-identity/gcp-workload-identity-federation-jwt.mdx
+1 -1
View File
@@ -417,5 +417,5 @@ Workload Identity.
Teleport Workload Identity.
- [Best Practices](./best-practices.mdx): Best practices for using Workload
Identity in Production.
- Read the [configuration reference](../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/machine-workload-identity/workload-identity/getting-started.mdx
+1 -1
View File
@@ -253,5 +253,5 @@ Workload Identity.
Identity in Production.
- Read the [Workload Identity reference](../../reference/machine-workload-identity/workload-identity/workload-identity-resource.mdx)
to explore the configuration of the Workload Identity resource.
- Read the [configuration reference](../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options for `tbot`.
docs/pages/machine-workload-identity/workload-identity/jwt-svids.mdx
+1 -1
View File
@@ -68,5 +68,5 @@ platforms:
Workload Identity.
- [Best Practices](./best-practices.mdx): Best practices for using Workload
Identity in Production.
- Read the [configuration reference](../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/machine-workload-identity/workload-identity/tsh.mdx
+1 -1
View File
@@ -90,5 +90,5 @@ Workload Identity.
Workload Identity.
- [Best Practices](./best-practices.mdx): Best practices for using Workload
Identity in Production.
- Read the [configuration reference](../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [configuration reference](../../reference/machine-workload-identity/configuration.mdx) to explore
all the available configuration options.
docs/pages/reference/architecture/machine-id-architecture.mdx
+1 -1
View File
@@ -79,7 +79,7 @@ it is executed. This consists of:
impersonated).
For more detail about the configuration options, see
[the reference.](../machine-workload-identity/machine-id/machine-id.mdx)
[the reference.](../machine-workload-identity/machine-workload-identity.mdx)
On initial load, `tbot` uses the configured join method to obtain a set of
credentials for the bot user from the Teleport Auth Service. It can then use
docs/pages/reference/architecture/relay.mdx
+1 -1
View File
@@ -101,7 +101,7 @@ $ tsh ssh --relay none root@nodename
...
```
The [`ssh-multiplexer`](../machine-workload-identity/machine-id/configuration.mdx#ssh-multiplexer) Machine ID service can be configured to use a Relay. Similarly to the behavior of `tsh`, if a Relay address is set in the service configuration, only servers available through the Relay will be accessible. It's possible to provide access to servers through the Relay and through the control plane from the same Machine ID instance by configuring two independent `ssh-multiplexer` services.
The [`ssh-multiplexer`](../machine-workload-identity/configuration.mdx#ssh-multiplexer) Machine ID service can be configured to use a Relay. Similarly to the behavior of `tsh`, if a Relay address is set in the service configuration, only servers available through the Relay will be accessible. It's possible to provide access to servers through the Relay and through the control plane from the same Machine ID instance by configuring two independent `ssh-multiplexer` services.
## More concepts
docs/pages/reference/cli/fdpass-teleport.mdx
+1 -1
View File
@@ -14,7 +14,7 @@ connections.
You should not need to manually invoke `fdpass-teleport` and it will
automatically be included in OpenSSH configurations generated by the Machine ID
SSH multiplexer service. For further information, see the
[Machine ID reference](../machine-workload-identity/machine-id/configuration.mdx).
[Machine ID reference](../machine-workload-identity/configuration.mdx).
## Usage
docs/pages/reference/cli/tbot.mdx
+13 -12
View File
@@ -7,8 +7,9 @@ tags:
- mwi
---
`tbot` is a CLI tool used with **Machine ID** that programatically issues and renews
short-lived certificates to any service account (e.g, a CI/CD server).
`tbot` is a CLI tool used with **Machine & Workload Identity** that
programatically issues and renews short-lived certificates to any service
account (e.g, a CI/CD server).
The primary commands for `tbot` are as follows:
@@ -16,8 +17,8 @@ The primary commands for `tbot` are as follows:
| - | - |
| `tbot help` | Outputs guidance for using commands with `tbot`. |
| `tbot version` | Outputs the current version of the `tbot` binary. |
| `tbot configure` | Outputs a basic Machine ID client configuration file to be adjusted as needed. |
| `tbot start` | Starts the Machine ID client `tbot`, fetching and writing certificates to disk at a set interval. |
| `tbot configure` | Outputs a basic `tbot` client configuration file to be adjusted as needed. |
| `tbot start` | Starts `tbot`, fetching and writing certificates to disk at a set interval. |
| `tbot init` | Initialize a certificate destination directory for writes from a separate bot user, configuring either file or POSIX ACL permissions. |
| `tbot db` | Connects to databases using native clients and queries database information. Functions as a wrapper for `tsh`, and requires `tsh` installation. |
| `tbot proxy` | Allows for access to Teleport resources on a cluster using TLS Routing. Functions as a wrapper for `tsh`, and requires `tsh` installation. |
@@ -35,8 +36,8 @@ Note that `tsh` must be installed to make use of this command.
| Flag | Description |
|---------------------|----------------------------------------------------------------------------------------------------------|
| `-d/--debug` | Enable verbose logging to stderr. |
| `-c/--config` | Path to a Machine ID configuration file. Required if not using other required configuration flags. |
| `--destination-dir` | Path to the Machine ID destination dir that should be used for authentication. Required. |
| `-c/--config` | Path to a `tbot` configuration file. Required if not using other required configuration flags. |
| `--destination-dir` | Path to the destination dir that should be used for authentication. Required. |
| `--proxy-server` | The `host:port` of the Teleport Proxy Service to use to access resources. Required. |
| `--cluster` | The name of the cluster on which resources should be accessed. Extracted from the bot identity if unset. |
@@ -63,7 +64,7 @@ client, configuring either file or POSIX ACL permissions.
Note that most use cases should instead use tbot's runtime ACL management by
specifying allowed reader users and groups in the
[destination configuration](../machine-workload-identity/machine-id/configuration.mdx#directory).
[destination configuration](../machine-workload-identity/configuration.mdx#directory).
### Flags
@@ -572,7 +573,7 @@ command supports these additional flags:
Issues an X509 workload identity credential using Teleport Workload Identity and
writes this credential to a specified destination.
See the [configuration reference](../machine-workload-identity/machine-id/configuration.mdx) for further
See the [configuration reference](../machine-workload-identity/configuration.mdx) for further
information about the workload identity credential output and the YAML
configuration file format.
@@ -595,7 +596,7 @@ command supports these additional flags:
Issues an X509 workload identity credential, exchanges this for short-lived AWS
credentials using Roles Anywhere, and writes these to a configured destination.
See the [configuration reference](../machine-workload-identity/machine-id/configuration.mdx) for further
See the [configuration reference](../machine-workload-identity/configuration.mdx) for further
information about the workload identity credential output and the YAML
configuration file format.
@@ -626,7 +627,7 @@ writes this credential to a specified destination.
The JWT workload identity credential is compatible with the [SPIFFE JWT SVID
specification](https://github.com/spiffe/spiffe/blob/main/standards/JWT-SVID.md).
See the [configuration reference](../machine-workload-identity/machine-id/configuration.mdx) for further
See the [configuration reference](../machine-workload-identity/configuration.mdx) for further
information about the workload identity credential output and the YAML
configuration file format.
@@ -734,7 +735,7 @@ new keypair.
| `--storage` | A destination URI to be used for bot internal storage. Required. |
| `--proxy-server` | A Teleport Proxy Service address. Required. |
| `--overwrite` | If set, always generate a new key. If unset, the existing public key will be printed if one already exists in the destination specified by `--storage`. |
| `--static` | If set, generates a static keypair. For more information, see [the static key guide](../machine-workload-identity/machine-id/bound-keypair/static-keys.mdx). |
| `--static` | If set, generates a static keypair. For more information, see [the static key guide](../machine-workload-identity/bound-keypair/static-keys.mdx). |
| `--static-key-path` | If set with `--static`, writes the static keypair to a file. |
| `--format` | Override the output format, supported values: `text`, `json`. |
@@ -759,7 +760,7 @@ To register the keypair with Teleport, include this public key in the token's
This public key, including the algorithm identifier (`ssh-ed25519`, but may vary
depending on your cluster configuration) can then be copied into a Bound Keypair
join token to be used as a
[preregistered key](../machine-workload-identity/machine-id/bound-keypair/concepts.mdx#onboarding).
[preregistered key](../machine-workload-identity/bound-keypair/concepts.mdx#onboarding).
Note that the Teleport Proxy Service address is required to fetch the currently
enabled [signature suite](../deployment/signature-algorithms.mdx). No authentication takes
docs/pages/reference/deployment/join-methods.mdx
+19 -2
View File
@@ -291,8 +291,8 @@ bots, and cannot be used to join other Teleport Agent types.
(!docs/pages/includes/provision-token/bound-keypair-spec.mdx!)
<Admonition type="note" title="See Also">
- [Deploying Machine ID with Bound Keypair joining](../machine-workload-identity/machine-id/bound-keypair/getting-started.mdx)
- [Bound Keypair Reference](../machine-workload-identity/machine-id/bound-keypair/bound-keypair.mdx)
- [Deploying Machine ID with Bound Keypair joining](../machine-workload-identity/bound-keypair/getting-started.mdx)
- [Bound Keypair Reference](../machine-workload-identity/bound-keypair/bound-keypair.mdx)
</Admonition>
### AWS IAM role: `iam`
@@ -389,6 +389,23 @@ Teleport-protected resources in GitHub Actions pipelines.
- [Deploying Machine ID on GitHub Actions](../../machine-workload-identity/machine-id/deployment/github-actions.mdx)
</Admonition>
#### GitHub Actions helpers
We offer a series of off-the-shelf GitHub Actions to use in your workflows when
utilizing Teleport Machine ID and GitHub Actions.
More information about these individual actions can be found in their GitHub
repositories:
- [https://github.com/teleport-actions/setup](https://github.com/teleport-actions/setup)
- [https://github.com/teleport-actions/auth](https://github.com/teleport-actions/auth)
- [https://github.com/teleport-actions/auth-k8s](https://github.com/teleport-actions/auth-k8s)
- [https://github.com/teleport-actions/auth-application](https://github.com/teleport-actions/auth-application)
If you experience problems when using these actions, please raise an issue in
their source repository:
[https://github.com/teleport-actions/root](https://github.com/teleport-actions/root).
### CircleCI: `circleci`
This join method is typically used with [Machine ID](../../machine-workload-identity/machine-id/introduction.mdx)
docs/pages/reference/infrastructure-as-code/resources.mdx
+1 -1
View File
@@ -352,7 +352,7 @@ version: v2
Bot resources define a Machine ID Bot identity and its access.
Find out more on the
[Machine ID configuration reference](../machine-workload-identity/machine-id/configuration.mdx).
[Machine ID configuration reference](../machine-workload-identity/configuration.mdx).
(!docs/pages/includes/machine-id/bot-spec.mdx!)
docs/pages/reference/machine-workload-identity/machine-id/bound-keypair/admin-guide.mdx → docs/pages/reference/machine-workload-identity/bound-keypair/admin-guide.mdx
+3 -3
View File
@@ -333,6 +333,6 @@ Frequently rotating static keys can help to mitigate the security tradeoffs of
`insecure` recovery. See the [concepts page](concepts.mdx#static-keys) for more
information about static keys.
[rbac]: ../../../access-controls/roles.mdx
[ephemeral]: ../../../architecture/machine-id-architecture.mdx#ephemeral-token
[delegated]: ../../../deployment/join-methods.mdx#delegated-join-methods
[rbac]: ../../access-controls/roles.mdx
[ephemeral]: ../../architecture/machine-id-architecture.mdx#ephemeral-token
[delegated]: ../../deployment/join-methods.mdx#delegated-join-methods
docs/pages/reference/machine-workload-identity/machine-id/bound-keypair/bound-keypair.mdx → docs/pages/reference/machine-workload-identity/bound-keypair/bound-keypair.mdx
+13 -12
View File
@@ -59,7 +59,7 @@ In particular, the [secure recovery modes](concepts.mdx#recovery) introduce some
restrictions:
- Each bot deployment must be issued a unique token. For deployment at scale,
use of Teleport's
[Terraform provider](../../../infrastructure-as-code/terraform-provider/terraform-provider.mdx) is
[Terraform provider](../../infrastructure-as-code/terraform-provider/terraform-provider.mdx) is
recommended to create tokens in bulk for each deployment.
- Each bot deployment must be able to store client-side state (used for
[join state verification](concepts.mdx#join-state-verification)).
@@ -71,20 +71,21 @@ used with care.
## Next steps
You can read step-by-step guides on using Bound Keypair Joining with Machine ID:
You can read step-by-step guides on using Bound Keypair Joining with
Machine & Workload Identity:
- [Using Machine ID with Bound Keypair Joining](./getting-started.mdx):
How to install and configure Machine ID with Bound Keypair Joining
- [Using Machine ID with Bound Keypair static keys](./static-keys.mdx): How to
use Bound Keypair static keys with stateless hosts, like otherwise
unsupported CI/CD providers
- [Using Bound Keypair Joining](./getting-started.mdx):
How to install and configure Machine & Workload Identity with Bound Keypair
Joining
- [Using Bound Keypair static keys](./static-keys.mdx): How to use Bound Keypair
static keys with stateless hosts, like otherwise unsupported CI/CD providers
- [Bound Keypair Joining Concepts](./concepts.mdx): Learn more about the
components and architecture of Bound Keypair Joining
- [Bound Keypair Joining Admin Guide](./admin-guide.mdx): Learn how to deploy
and maintain bots in production with Bound Keypair Joining
- [Bound Keypair Provision Token Reference](../../../deployment/join-methods.mdx#bound-keypair-bound_keypair): Learn about the options that can be configured for a `bound_keypair` token
- [Bound Keypair Provision Token Reference](../../deployment/join-methods.mdx#bound-keypair-bound_keypair): Learn about the options that can be configured for a `bound_keypair` token
[delegated]: ../../../deployment/join-methods.mdx#delegated-join-methods
[ephemeral]: ../../../architecture/machine-id-architecture.mdx#ephemeral-token
[token]: ../../../deployment/join-methods.mdx#ephemeral-tokens
[s-vs-d]: ../../../deployment/join-methods.mdx#secret-vs-delegated
[delegated]: ../../deployment/join-methods.mdx#delegated-join-methods
[ephemeral]: ../../architecture/machine-id-architecture.mdx#ephemeral-token
[token]: ../../deployment/join-methods.mdx#ephemeral-tokens
[s-vs-d]: ../../deployment/join-methods.mdx#secret-vs-delegated
docs/pages/reference/machine-workload-identity/machine-id/bound-keypair/concepts.mdx → docs/pages/reference/machine-workload-identity/bound-keypair/concepts.mdx
+3 -3
View File
@@ -183,8 +183,8 @@ With this context in mind, when using static keys, be aware that any client with
knowledge of the private key can authenticate to Teleport with no additional
restrictions. Before deploying a bot with static keys, take additional care to
fully understand your environment's threat model and security needs, and reduce
access using [Teleport's RBAC](../../../access-controls/roles.mdx) to ensure the
access using [Teleport's RBAC](../../access-controls/roles.mdx) to ensure the
minimum possible blast radius in the event the keypair is compromised.
[renewable]: ../../../deployment/join-methods.mdx#renewable-vs-non-renewable
[token]: ../../../deployment/join-methods.mdx#ephemeral-tokens
[renewable]: ../../deployment/join-methods.mdx#renewable-vs-non-renewable
[token]: ../../deployment/join-methods.mdx#ephemeral-tokens
docs/pages/reference/machine-workload-identity/machine-id/bound-keypair/getting-started.mdx → docs/pages/reference/machine-workload-identity/bound-keypair/getting-started.mdx
+8 -8
View File
@@ -1,6 +1,6 @@
---
title: Deploying Machine ID with Bound Keypair Joining
description: "How to install and configure Machine ID with Bound Keypair Joining"
title: Deploying tbot with Bound Keypair Joining
description: "How to install and configure tbot with Bound Keypair Joining"
tags:
- mwi
- how-to
@@ -21,7 +21,7 @@ extended outage.
Note that platform-specific join methods may be available that are better suited
to your environment; refer to the
[deployment guides](../../../../machine-workload-identity/machine-id/deployment/deployment.mdx)
[deployment guides](../../../machine-workload-identity/machine-id/deployment/deployment.mdx)
for a full list of options.
## How it works
@@ -72,8 +72,8 @@ method works and how to use it in production.
**This step is completed on the bot host.**
First, `tbot` needs to be installed on the host that you wish to use Machine ID
on.
First, `tbot` needs to be installed on the host that you wish to use Machine &
Workload Identity on.
Download and install the appropriate Teleport package for your platform:
@@ -227,7 +227,7 @@ public key string in a JSON document for use in scripts.
Note that while a proxy server address must be provided, this is only used to
ping the cluster to determine its configured
[signature algorithms](../../../deployment/signature-algorithms.mdx). Once the keypair has been
[signature algorithms](../../deployment/signature-algorithms.mdx). Once the keypair has been
generated, the public key will be printed to the console.
Next, on your local machine, create a file named `token-example.yaml`:
@@ -293,11 +293,11 @@ Joining, refer to the [onboarding reference](./concepts.mdx#onboarding).
- Read the [Bound Keypair Joining Reference][reference]
for more details about the join method and the available configuration options.
- Follow the [access guides](../../../../machine-workload-identity/machine-id/access-guides/access-guides.mdx)
- Follow the [access guides](../../../machine-workload-identity/machine-id/access-guides/access-guides.mdx)
to finish configuring `tbot` for your environment.
- Read the [configuration reference](../configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../telemetry.mdx)
[secret]: ../../../deployment/join-methods.mdx#secret-vs-delegated
[secret]: ../../deployment/join-methods.mdx#secret-vs-delegated
[reference]: ./bound-keypair.mdx
docs/pages/reference/machine-workload-identity/machine-id/bound-keypair/static-keys.mdx → docs/pages/reference/machine-workload-identity/bound-keypair/static-keys.mdx
+8 -8
View File
@@ -1,6 +1,6 @@
---
title: Deploying Machine ID with Bound Keypair Static Keys
description: "How to install and configure Machine ID with Bound Keypair static keys"
title: Deploying tbot with Bound Keypair Static Keys
description: "How to install and configure tbot with Bound Keypair static keys"
tags:
- mwi
- how-to
@@ -10,7 +10,7 @@ tags:
In this guide, you will install Machine and Workload Identity's agent, `tbot`,
on an arbitrary stateless environment using Bound Keypair static keys. This
might be a CI/CD job on a provider not yet supported by one of Teleport's
[dedicated join methods](../../../deployment/join-methods.mdx), an ephemeral
[dedicated join methods](../../deployment/join-methods.mdx), an ephemeral
bare-metal node, or any other environment without writable persistent storage.
Bound Keypair Joining is a more flexible alternative to [secret-based join
@@ -39,7 +39,7 @@ your static private key instead of managing it automatically.
Static key joining relaxes certain security checks otherwise performed when
client-side storage is available. This is designed to be used where no other
join methods are possible. Before continuing, consider:
- Using a [dedicated join method](../../../deployment/join-methods.mdx) for your
- Using a [dedicated join method](../../deployment/join-methods.mdx) for your
platform if available.
- Using [standard Bound Keypair joining](./getting-started.mdx) if your
environment has writable persistent storage.
@@ -63,8 +63,8 @@ environment.
**This step is completed on the bot host.**
First, `tbot` needs to be installed on the host that you wish to use Machine ID
on.
First, `tbot` needs to be installed on the host that you wish to use Machine &
Workload Identity on.
Download and install the appropriate Teleport package for your platform:
@@ -288,11 +288,11 @@ longer-running jobs, otherwise the certificates issued will expire eventually
- Read about [static key rotation](./admin-guide.mdx#manually-rotating-static-keys)
- Read the [Bound Keypair Joining Reference][reference]
for more details about the join method and the available configuration options.
- Follow the [access guides](../../../../machine-workload-identity/machine-id/access-guides/access-guides.mdx)
- Follow the [access guides](../../../machine-workload-identity/machine-id/access-guides/access-guides.mdx)
to finish configuring `tbot` for your environment.
- Read the [configuration reference](../configuration.mdx) to explore
all the available configuration options.
- [More information about `TELEPORT_ANONYMOUS_TELEMETRY`.](../telemetry.mdx)
[secret]: ../../../deployment/join-methods.mdx#secret-vs-delegated
[secret]: ../../deployment/join-methods.mdx#secret-vs-delegated
[reference]: ./bound-keypair.mdx
docs/pages/reference/machine-workload-identity/machine-id/configuration.mdx → docs/pages/reference/machine-workload-identity/configuration.mdx
+18 -18
View File
@@ -1,7 +1,7 @@
---
title: Machine ID Configuration Reference
title: Machine & Workload Identity Configuration Reference
sidebar_label: Configuration
description: Configuration reference for Teleport Machine ID.
description: Configuration reference for Teleport Machine & Workload Identity.
toc_max_heading_level: 4
tags:
- infrastructure-as-code
@@ -226,7 +226,7 @@ The `identity` output can be used to authenticate:
- Management of Teleport resources using the Teleport Terraform provider.
- Access to the Teleport API using the Teleport Go SDK.
See the [Getting Started guide](../../../machine-workload-identity/getting-started.mdx) to see the `identity`
See the [Getting Started guide](../../machine-workload-identity/getting-started.mdx) to see the `identity`
output used in context.
```yaml
@@ -252,7 +252,7 @@ allow_reissue: false
The `application` output is used to generate credentials that can be used to
access applications that have been configured with Teleport.
See the [Machine ID with Applications guide](../../../machine-workload-identity/machine-id/access-guides/applications.mdx)
See the [Machine & Workload Identity with Applications guide](../../machine-workload-identity/machine-id/access-guides/applications.mdx)
to see the `application` output used in context.
```yaml
@@ -272,7 +272,7 @@ app_name: grafana
The `database` output is used to generate credentials that can be used to
access databases that have been configured with Teleport.
See the [Machine ID with Databases guide](../../../machine-workload-identity/machine-id/access-guides/databases.mdx)
See the [Machine & Workload Identity with Databases guide](../../machine-workload-identity/machine-id/access-guides/databases.mdx)
to see the `database` output used in context.
```yaml
@@ -318,7 +318,7 @@ access Kubernetes clusters that have been configured with Teleport.
It outputs a `kubeconfig.yaml` in the output destination, which can be used
with `kubectl`.
See the [Machine ID with Kubernetes Clusters guide](../../../machine-workload-identity/machine-id/access-guides/kubernetes.mdx)
See the [Machine & Workload Identity with Kubernetes Clusters guide](../../machine-workload-identity/machine-id/access-guides/kubernetes.mdx)
to see the `kubernetes` output used in context.
```yaml
@@ -434,7 +434,7 @@ a secret containing connection details and short-lived credentials, labeled with
`"argocd.argoproj.io/secret-type": "cluster"` for Argo CD to discover.
As such, it is only intended to be used within a Kubernetes cluster. See the
[Machine ID with Argo CD guide](../../../machine-workload-identity/machine-id/access-guides/argocd.mdx)
[Machine & Workload Identity with Argo CD guide](../../machine-workload-identity/machine-id/access-guides/argocd.mdx)
for information on how to deploy it using the Helm chart.
<Admonition type="warning" >
@@ -563,7 +563,7 @@ The output generates the following artifacts:
- `svid.key`: the private key associated with the X509 SVID.
- `bundle.pem`: the X509 bundle that contains the trust domain CAs.
See [Workload Identity introduction](../../../machine-workload-identity/workload-identity/introduction.mdx)
See [Workload Identity introduction](../../machine-workload-identity/workload-identity/introduction.mdx)
for more information on Workload Identity functionality.
```yaml
@@ -586,7 +586,7 @@ The output generates the following artifacts:
- `jwt_svid`: the JWT SVID.
See [Workload Identity introduction](../../../machine-workload-identity/workload-identity/introduction.mdx)
See [Workload Identity introduction](../../machine-workload-identity/workload-identity/introduction.mdx)
for more information on Workload Identity functionality.
```yaml
@@ -622,7 +622,7 @@ The output generates the following artifacts:
- `aws_credentials`: the CLI and SDK compatible AWS shared credentials file.
See [Workload Identity introduction](../../../machine-workload-identity/workload-identity/introduction.mdx)
See [Workload Identity introduction](../../machine-workload-identity/workload-identity/introduction.mdx)
for more information on Workload Identity functionality.
```yaml
@@ -688,7 +688,7 @@ new Workload Identity configuration experience. You can replace the use of this
output with the new `workload-identity-x509` or `workload-identity-jwt` service.
For further information, see [the new Workload Identity configuration experience
and how to migrate](../workload-identity/configuration-resource-migration.mdx).
and how to migrate](./workload-identity/configuration-resource-migration.mdx).
</Admonition>
The `spiffe-svid` output is used to generate a SPIFFE X509 SVID and write this
@@ -704,7 +704,7 @@ An artifact will also be generated for each entry within the `jwts` list. This
will be named according to `file_name`. This artifact will contain only the
JWT-SVID with the audience specified in `audience`.
See [Workload Identity](../../../machine-workload-identity/workload-identity/introduction.mdx) for more information on how
See [Workload Identity](../../machine-workload-identity/workload-identity/introduction.mdx) for more information on how
to use SPIFFE SVIDs.
```yaml
@@ -752,7 +752,7 @@ workload identity API, intended to serve workload identity credentials
(e.g X509/JWT SPIFFE SVIDs) to workloads running on the same host.
For more information about this, see the
[Workload Identity API and Workload Attestation reference](../workload-identity/workload-identity-api-and-workload-attestation.mdx)
[Workload Identity API and Workload Attestation reference](./workload-identity/workload-identity-api-and-workload-attestation.mdx)
The `workload-identity-api` service will not start if `tbot` has been configured
to run in one-shot mode.
@@ -765,14 +765,14 @@ new Workload Identity configuration experience. You can replace the use of this
service with the new `workload-identity-api` service.
For further information, see [the new Workload Identity configuration experience
and how to migrate](../workload-identity/configuration-resource-migration.mdx).
and how to migrate](./workload-identity/configuration-resource-migration.mdx).
</Admonition>
The `spiffe-workload-api` service opens a listener for a service that implements
the SPIFFE Workload API. This service is used to provide SPIFFE SVIDs to
workloads.
See [Workload Identity](../../../machine-workload-identity/workload-identity/introduction.mdx) for more information on the
See [Workload Identity](../../machine-workload-identity/workload-identity/introduction.mdx) for more information on the
SPIFFE Workload API.
```yaml
@@ -1166,7 +1166,7 @@ This differs to using `identity` output for SSH in a few ways:
- Resource consumption is significantly reduced by multiplexing SSH connections
through a fewer number of upstream connections to the Teleport Proxy Service.
- It's possible to configure the `ssh-multiplexer` service to connect to SSH
servers through a [Teleport Relay](../../architecture/relay.mdx).
servers through a [Teleport Relay](../architecture/relay.mdx).
Additionally, the `ssh-multiplexer` opens a socket that implements the SSH
agent protocol. This allows the SSH client to authenticate without writing the
@@ -1572,8 +1572,8 @@ labels:
## Bot resource
The `bot` resource is used to manage Machine ID Bots. It is used to configure
the access that is granted to a Bot.
The `bot` resource is used to manage Machine & Workload Identity Bots. It is
used to configure the access that is granted to a Bot.
(!docs/pages/includes/machine-id/bot-spec.mdx!)
docs/pages/reference/machine-workload-identity/machine-id/diagnostics-service.mdx → docs/pages/reference/machine-workload-identity/diagnostics-service.mdx
View File
docs/pages/reference/machine-workload-identity/machine-id/github-actions.mdx
-50
View File
@@ -1,50 +0,0 @@
---
title: GitHub Actions
description: Reference for GitHub Actions joining
tags:
- ci-cd
- conceptual
- mwi
- infrastructure-identity
---
This document acts a reference for GitHub Actions and Machine ID. You will find
links to in-depth guides on using GitHub Actions and a full explanation of the
configuration options available when using the GitHub join method.
## Guides
You can read step-by-step guides on using Machine ID and GitHub Actions:
- [Using Machine ID with GitHub Actions](../../../machine-workload-identity/machine-id/deployment/github-actions.mdx): How to
use Machine ID to SSH into Teleport nodes from GitHub Actions.
## GitHub join token
The `token` resource sets out rules for what is allowed to join a Teleport
cluster. Joining clients must specify which `token` they want to use, and then
information included in their join request is compared to the rules contained
within the token by the Auth Service to determine whether or not they should be
admitted.
The following snippet shows all available options in the `token` resource when
used for GitHub joining with Machine ID:
(!docs/pages/includes/provision-token/github-spec.mdx!)
## GitHub Actions helpers
We offer a series of off-the-shelf GitHub Actions to use in your workflows when
utilizing Teleport Machine ID and GitHub Actions.
More information about these individual actions can be found in their GitHub
repositories:
- [https://github.com/teleport-actions/setup](https://github.com/teleport-actions/setup)
- [https://github.com/teleport-actions/auth](https://github.com/teleport-actions/auth)
- [https://github.com/teleport-actions/auth-k8s](https://github.com/teleport-actions/auth-k8s)
- [https://github.com/teleport-actions/auth-application](https://github.com/teleport-actions/auth-application)
If you experience problems when using these actions, please raise an issue in
their source repository:
[https://github.com/teleport-actions/root](https://github.com/teleport-actions/root).
docs/pages/reference/machine-workload-identity/machine-id/gitlab.mdx
-28
View File
@@ -1,28 +0,0 @@
---
title: GitLab CI
description: Reference for GitLab joining
tags:
- reference
- mwi
- infrastructure-identity
---
This document acts a reference for GitLab CI and Machine ID. You will find
links to in-depth guides as well as a full description of the configuration
options available when using the GitLab join method.
## Guides
You can read step-by-step guides on using Machine ID and GitLab CI:
- [Using Machine ID with GitLab](../../../machine-workload-identity/machine-id/deployment/gitlab.mdx): How to
use Machine ID to SSH into Teleport nodes from GitLab CI.
## GitLab join token
A GitLab join token contains allow rules that describe which pipelines can
use that token in order to join the Teleport cluster. A rule can contain
multiple fields, and any pipeline that matches all of the fields within a
single rule is granted access.
(!docs/pages/includes/provision-token/gitlab-spec.mdx!)
docs/pages/reference/machine-workload-identity/machine-id/machine-id.mdx
-17
View File
@@ -1,17 +0,0 @@
---
title: Machine ID References
sidebar_label: Machine ID
description: Configuration and CLI reference for Teleport Machine ID.
tags:
- mwi
---
- [Configuration](configuration.mdx)
- [Diagnostics Service](diagnostics-service.mdx)
- [GitHub Actions](github-actions.mdx)
- [GitLab CI](gitlab.mdx)
- [CLI](../../cli/tbot.mdx)
- [Telemetry](telemetry.mdx)
- [V16 Upgrade Guide](v16-upgrade-guide.mdx)
- [Bot Terraform Resource](../../infrastructure-as-code/terraform-provider/resources/bot.mdx)
- [Bound Keypair Joining](bound-keypair/bound-keypair.mdx)
docs/pages/reference/machine-workload-identity/machine-id/v16-upgrade-guide.mdx
-70
View File
@@ -1,70 +0,0 @@
---
title: Machine ID v16 Upgrade Guide
sidebar_label: Upgrading to v16
description: Upgrade instructions for Machine ID in Teleport 16.0
tags:
- how-to
- mwi
---
Teleport 16.0 introduces a number of changes to Machine ID. These changes may require action on your part if you use Machine ID with OpenSSH or OpenSSH-based clients (e.g. Ansible).
This guide explains how to migrate your Teleport 16.0 cluster for continued Machine ID support.
## Changes OpenSSH support and the `tbot proxy ssh` command
When using Machine ID with an OpenSSH client, an `ssh_config` is generated and
used to configure the OpenSSH client.
Within the `ssh_config`, the `ProxyCommand` directive specifies a special
command to be used to connect to the target host.
Historically, this command would be `tbot proxy ssh`.
We have now introduced a new command: `tbot ssh-proxy-command`. This has
a number of benefits:
- `tsh` is no longer required to be installed on the machine.
- The amount of CPU and memory used during a connection is significantly reduced.
- The time taken to establish a connection is significantly reduced.
This command was introduced in a Teleport 15 release, and from Teleport 16.0
will become used by default in the generated `ssh_config`. From Teleport 17.0,
the `tbot proxy ssh` command will no longer be supported and will be removed.
### Actions required
If you are using Machine ID with OpenSSH or OpenSSH based clients, you may need
to take action.
#### Using the default `ssh_config`
If you are using the default generated `ssh_config`, then no explicit action
on your behalf should be necessary. From 16.0, the new command will be
automatically used.
We do recommend that you perform a test-run when updating to ensure that
everything is working as expected. You can revert to the old behaviour by
setting the `TBOT_SSH_CONFIG_PROXY_COMMAND_MODE` environment variable to
`legacy` in the environment in which you are running `tbot`:
```code
$ export TBOT_SSH_CONFIG_PROXY_COMMAND_MODE=legacy
$ tbot start -c config.yaml
```
#### Using a modified `ssh_config`
If you have modified the `ssh_config` and therefore do not use the default
`ssh_config` generated by `tbot`, then you will need to manually update the
file. You must do this before 17.0, but we recommend doing this in 16.0 to
benefit from the performance improvements.
To update your modified `ssh_config`, we recommend running an instance of `tbot`
as you would usually configure it. This will generate a new `ssh_config`.
Carefully inspect the `ProxyCommand` directive, and copy the new command to
your modified `ssh_config`.
You can find a full list of the parameters available for the
`tbot ssh-proxy-command` on the
[CLI reference page](../../cli/tbot.mdx).
docs/pages/reference/machine-workload-identity/machine-id/telemetry.mdx → docs/pages/reference/machine-workload-identity/telemetry.mdx
+12 -12
View File
@@ -1,22 +1,22 @@
---
title: Telemetry
description: An explanation of the telemetry collected by Machine ID
description: An explanation of the telemetry collected by Machine & Workload Identity
tags:
- conceptual
- mwi
---
This document explains what telemetry is collected by the Machine ID `tbot`
agent, why we want to collect this telemetry and, how to opt in or out.
This document explains what telemetry is collected by the `tbot` agent, why we
want to collect this telemetry and, how to opt in or out.
## Why?
Machine ID is an emerging part of the Teleport product and it's helpful for us
to be able to identify the kinds of use-cases people have. This allows us to
prioritise more common usages. Whilst we try to collect this sort of information
by talking to users directly, having a more general overview of the product in
the wild helps us make even more informed decisions and avoid our decisions
being solely influenced by a select few users.
Machine & Workload Identity is an emerging part of the Teleport product and it's
helpful for us to be able to identify the kinds of use-cases people have. This
allows us to prioritise more common usages. Whilst we try to collect this sort
of information by talking to users directly, having a more general overview of
the product in the wild helps us make even more informed decisions and avoid our
decisions being solely influenced by a select few users.
## Anonymous telemetry
@@ -28,9 +28,9 @@ that the collected data does not include anything which identifies:
- the hosts, applications, databases and Kubernetes clusters `tbot` connects to
- the user that has configured `tbot`
If we introduce further events to Machine ID's anonymous telemetry in future,
we will abide by the above guidelines and ensure that changes are explicitly
included in changelogs where new information is gathered.
If we introduce further events to Machine & Workload Identity's anonymous
telemetry in future, we will abide by the above guidelines and ensure that
changes are explicitly included in changelogs where new information is gathered.
Whilst we do not collect data which uniquely identifies the specific machine
`tbot` is running on, we may collect general information about the architecture
docs/pages/reference/machine-workload-identity/workload-identity/configuration-resource-migration.mdx
+1 -1
View File
@@ -62,4 +62,4 @@ The following new additional service types have been introduced:
- `workload-identity-jwt` to issue JWT SVIDs.
You can read more about the new service types in the
[`tbot` configuration reference](../machine-id/configuration.mdx).
[`tbot` configuration reference](../configuration.mdx).
docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/dedicated-server.mdx
+1 -1
View File
@@ -165,5 +165,5 @@ $ tctl get role/terraform-test
- Explore the
[Terraform provider resource reference](../../../reference/infrastructure-as-code/terraform-provider/terraform-provider.mdx)
to discover what can be configured with the Teleport Terraform provider.
- Read the [tbot configuration reference](../../../reference/machine-workload-identity/machine-id/configuration.mdx) to explore
- Read the [tbot configuration reference](../../../reference/machine-workload-identity/configuration.mdx) to explore
all the available `tbot` configuration options.
docs/pages/zero-trust-access/infrastructure-as-code/terraform-provider/spacelift.mdx
+1 -1
View File
@@ -227,5 +227,5 @@ $ tctl get users/terraform-test
to authenticate to your Teleport cluster, read [the Spacelift
documentation](https://docs.spacelift.io/integrations/cloud-providers/oidc/).
- Learn how you can help achieve secure access for service accounts by sending
[anonymous Machine ID telemetry](../../../reference/machine-workload-identity/machine-id/telemetry.mdx).
[anonymous Machine ID telemetry](../../../reference/machine-workload-identity/telemetry.mdx).
docs/pages/zero-trust-access/management/operations/ca-rotation.mdx
+2 -2
View File
@@ -374,7 +374,7 @@ After the rotation is complete, make sure to remove the old CA from the AWS IAM
### `bound_keypair`
The `bound_keypair` CA signs JWTs issued for [Bound Keypair join state
verification](../../../reference/machine-workload-identity/machine-id/bound-keypair/concepts.mdx#join-state-verification).
verification](../../../reference/machine-workload-identity/bound-keypair/concepts.mdx#join-state-verification).
This is an additional document stored by clients that join your Teleport cluster
using the `bound_keypair` join method that uniquely identifies each join
attempt, and is additionally verified by Teleport during subsequent joins.
@@ -391,7 +391,7 @@ join state JWT.
If join state verification fails after a CA rotation, you can allow clients to
join again by [temporarily disabling join state
verification](../../../reference/machine-workload-identity/machine-id/bound-keypair/admin-guide.mdx#recovery-after-a-cluster-rollback).
verification](../../../reference/machine-workload-identity/bound-keypair/admin-guide.mdx#recovery-after-a-cluster-rollback).
They will be issued a new join state JWT on their next join, after which
join state verification can be safely reenabled.