gravitational/teleport
1
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-10-11 22:49:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add enum value rendering to CLI docs and remove duplicate descriptions (#66466)

Browse Source 
This commit enhances the CLI reference documentation by automatically
displaying valid enum values in the "Default" column of flag tables,
eliminating the need to manually list these values in flag descriptions.
It also adds a CI step to verify that CLI reference docs stay in sync
with source code changes.

The core implementation uses reflection to extract enum values from
kingpin flags and formats them as "(valid: `value1`, `value2`, ...)".
All CLI source files have been updated to remove duplicate enum value
lists from flag help text, as these are now automatically rendered.

A new 'cli-docs-up-to-date' Makefile target and corresponding GitHub
Actions workflow job ensure that any changes to CLI flags are reflected
in the generated documentation.

Example output:
Before: |`--format`|`yaml`|Output format, 'yaml', 'json', or 'text'|
After:  |`--format`|`yaml` (valid: `yaml`, `json`, `text`)|Output format.|

Signed-off-by: Tiago Silva <[email protected]>
This commit is contained in:
Tiago Silva
2026-05-08 13:53:15 +00:00
committed by GitHub
parent 5360b7790a
commit fb98c980ec
32 changed files with 1949 additions and 1570 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/lint.yaml
+32
View File
@@ -18,6 +18,7 @@ jobs:
has_rfd: ${{ steps.changes.outputs.has_rfd }}
has_ui: ${{ steps.changes.outputs.has_ui }}
has_bpf: ${{ steps.changes.outputs.has_bpf }}
has_cli: ${{ steps.changes.outputs.has_cli }}
steps:
- name: Checkout
if: ${{ github.event_name == 'merge_group' }}
@@ -94,6 +95,17 @@ jobs:
- 'bpf/**.c'
- 'bpf/**.h'
- 'lib/bpf/*'
has_cli:
- '.github/workflows/lint.yaml'
- 'tool/tsh/**.go'
- 'tool/tctl/**.go'
- 'tool/tbot/**.go'
- 'tool/teleport/**.go'
- 'lib/utils/usage_docs.go'
- 'lib/utils/usage_docs_test.go'
- 'lib/utils/docs-usage.md.tmpl'
- 'lib/utils/docsconfigs/**'
- 'docs/pages/reference/cli/**'
lint-go:
name: Lint (Go)
@@ -392,3 +404,23 @@ jobs:
- name: Check if BPF generated files are up to date
# We have to add the current directory as a safe directory or else git commands will not work as expected.
run: git config --global --add safe.directory $(realpath .) && make bpf-up-to-date
lint-cli:
name: CLI Reference Docs
needs: changes
if: ${{ !startsWith(github.head_ref, 'dependabot/') && needs.changes.outputs.has_cli == 'true' }}
runs-on: ubuntu-22.04-16core
permissions:
contents: read
container:
image: ghcr.io/gravitational/teleport-buildbox:teleport19
steps:
- name: Checkout
uses: actions/checkout@v6
- name: Check if CLI reference docs are up to date
# We have to add the current directory as a safe directory or else git commands will not work as expected.
run: git config --global --add safe.directory $(realpath .) && make cli-docs-up-to-date
Makefile
+18 -4
View File
@@ -2024,12 +2024,14 @@ dump-preset-roles:
GOOS=$(OS) GOARCH=$(ARCH) $(CGOFLAG) go run ./build.assets/dump-preset-roles/main.go
pnpm test web/packages/teleport/src/Roles/RoleEditor/StandardEditor/standardmodel.test.ts
cli-docs: cli-docs-tsh cli-docs-tbot cli-docs-teleport cli-docs-tctl
.PHONY: cli-docs-tsh
cli-docs-tsh:
# Executing go build instead of go run since we don't want to redirect
# irrelevant output along with the docs page content.
go build -o $(BUILDDIR)/tshdocs -tags docs ./tool/tsh && \
$(BUILDDIR)/tshdocs help 2>docs/pages/reference/cli/tsh.mdx && \
$(BUILDDIR)/tshdocs help >docs/pages/reference/cli/tsh.mdx && \
rm $(BUILDDIR)/tshdocs
.PHONY: cli-docs-tbot
@@ -2037,7 +2039,7 @@ cli-docs-tbot:
# Executing go build instead of go run since we don't want to redirect
# irrelevant output along with the docs page content.
go build -o $(BUILDDIR)/tbotdocs -tags docs ./tool/tbot && \
$(BUILDDIR)/tbotdocs help 2>docs/pages/reference/cli/tbot.mdx && \
$(BUILDDIR)/tbotdocs help >docs/pages/reference/cli/tbot.mdx && \
rm $(BUILDDIR)/tbotdocs
.PHONY: cli-docs-teleport
@@ -2045,7 +2047,7 @@ cli-docs-teleport:
# Executing go build instead of go run since we don't want to redirect
# irrelevant output along with the docs page content.
go build -o $(BUILDDIR)/teleportdocs -tags docs ./tool/teleport && \
$(BUILDDIR)/teleportdocs help 2>docs/pages/reference/cli/teleport.mdx && \
$(BUILDDIR)/teleportdocs help >docs/pages/reference/cli/teleport.mdx && \
rm $(BUILDDIR)/teleportdocs
.PHONY: cli-docs-tctl
@@ -2053,9 +2055,21 @@ cli-docs-tctl:
# Executing go build instead of go run since we don't want to redirect
# irrelevant output along with the docs page content.
go build -o $(BUILDDIR)/tctldocs -tags docs ./tool/tctl && \
$(BUILDDIR)/tctldocs help 2>docs/pages/reference/cli/tctl.mdx && \
$(BUILDDIR)/tctldocs help >docs/pages/reference/cli/tctl.mdx && \
rm $(BUILDDIR)/tctldocs
# cli-docs-up-to-date checks if the generated CLI reference docs are up to date.
.PHONY: cli-docs-up-to-date
cli-docs-up-to-date: must-start-clean/host cli-docs
@if ! git diff --quiet -- docs/pages/reference/cli/; then \
echo ""; \
echo "CLI reference documentation is out of date."; \
echo "Please run 'make cli-docs' and commit the changes."; \
echo ""; \
git diff --stat -- docs/pages/reference/cli/; \
exit 1; \
fi
# audit-event-reference generates audit event reference docs using the Web UI
# source.
.PHONY: audit-event-reference
docs/pages/reference/cli/tbot.mdx
+688 -658
View File
File diff suppressed because it is too large Load Diff
docs/pages/reference/cli/tctl.mdx
+366 -366
View File
File diff suppressed because it is too large Load Diff
docs/pages/reference/cli/teleport.mdx
+228 -207
View File
@@ -34,23 +34,23 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--auth-server`|none|Address of the auth server \[127.0.0.1:3025\].|
|`--ca-pin`|none|CA pin to validate the auth server (can be repeated for multiple pins).|
|`-c`, `--config`|none|Path to a configuration file \[/etc/teleport.yaml\].|
|`--cloud`|none|Set to one of \[AWS Azure GCP\] if application should proxy particular cloud API|
|`--diag-addr`|none|Start diagnostic prometheus and healthz endpoint.|
|`--auth-server`|*no default*|Address of the auth server \[127.0.0.1:3025\].|
|`--ca-pin`|*no default*|CA pin to validate the auth server (can be repeated for multiple pins).|
|`-c`, `--config`|*no default*|Path to a configuration file \[/etc/teleport.yaml\].|
|`--cloud`|*no default*|Set to one of \[AWS Azure GCP\] if application should proxy particular cloud API|
|`--diag-addr`|*no default*|Start diagnostic prometheus and healthz endpoint.|
|`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr.|
|`--labels`|none|Comma-separated list of labels for this node, for example env=dev,app=web.|
|`--name`|none|Name of the application to start.|
|`--labels`|*no default*|Comma-separated list of labels for this node, for example env=dev,app=web.|
|`--name`|*no default*|Name of the application to start.|
|`--[no-]fips`|`false`|Start Teleport in FedRAMP/FIPS 140 mode.|
|`--[no-]insecure`|`false`|Insecure mode disables certificate validation|
|`--[no-]mcp-demo-server`|`false`|Enables the Teleport demo MCP server that shows current user and session information.|
|`--[no-]no-debug-service`|`false`|Disables debug service.|
|`--[no-]skip-version-check`|`false`|Skip version checking between server and client.|
|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.|
|`--public-addr`|none|Public address of the application to proxy.|
|`--token`|none|Invitation token or path to file with token value to register with an auth server \[none\].|
|`--uri`|none|Internal address of the application to proxy.|
|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.|
|`--public-addr`|*no default*|Public address of the application to proxy.|
|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server \[none\].|
|`--uri`|*no default*|Internal address of the application to proxy.|
## teleport backend clone
@@ -76,7 +76,7 @@ Arguments:
|Argument|Default|Description|
|---|---|---|
|key|none (required)|The backend key to retrieve.|
|key|*no default* (required)|The backend key to retrieve.|
## teleport backend get
@@ -92,13 +92,13 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`-f`, `--format`|`text`|Format output (text, json, yaml).|
|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).|
Arguments:
|Argument|Default|Description|
|---|---|---|
|key|none (required)|The backend key to retrieve.|
|key|*no default* (required)|The backend key to retrieve.|
## teleport backend ls
@@ -114,13 +114,13 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`-f`, `--format`|`text`|Format output (text, json, yaml).|
|`-f`, `--format`|`text` (one of: `text`, `json`, `yaml`)|Format output (text, json, yaml).|
Arguments:
|Argument|Default|Description|
|---|---|---|
|prefix|none (optional)|An optional key prefix to limit listing to.|
|prefix|*no default* (optional)|An optional key prefix to limit listing to.|
## teleport backend rm
@@ -136,7 +136,7 @@ Arguments:
|Argument|Default|Description|
|---|---|---|
|key|none (required)|The backend key to remove.|
|key|*no default* (required)|The backend key to remove.|
## teleport configure
@@ -152,25 +152,25 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--acme-email`|none|Email to receive updates from Letsencrypt.org.|
|`--app-name`|none|Name of the application to start when using app role.|
|`--app-uri`|none|Internal address of the application to proxy.|
|`--auth-server`|none|Address of the auth server.|
|`--cert-file`|none|Path to a TLS certificate file for the proxy.|
|`--cluster-name`|none|Unique cluster name, e.g. example.com.|
|`--acme-email`|*no default*|Email to receive updates from Letsencrypt.org.|
|`--app-name`|*no default*|Name of the application to start when using app role.|
|`--app-uri`|*no default*|Internal address of the application to proxy.|
|`--auth-server`|*no default*|Address of the auth server.|
|`--cert-file`|*no default*|Path to a TLS certificate file for the proxy.|
|`--cluster-name`|*no default*|Unique cluster name, e.g. example.com.|
|`--data-dir`|`/var/lib/teleport`|Path to a directory where Teleport keep its data.|
|`--join-method`|`token`|Method to use to join the cluster (azure, azure_devops, bitbucket, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)|
|`--key-file`|none|Path to a TLS key file for the proxy.|
|`--join-method`|`token` (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `ec2`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.|
|`--key-file`|*no default*|Path to a TLS key file for the proxy.|
|`--[no-]acme`|`false`|Get automatic certificate from Letsencrypt.org using ACME.|
|`--node-labels`|none|Comma-separated list of labels to add to newly created nodes, for example env=staging,cloud=aws.|
|`--node-name`|none|Name for the Teleport node.|
|`--node-labels`|*no default*|Comma-separated list of labels to add to newly created nodes, for example env=staging,cloud=aws.|
|`--node-name`|*no default*|Name for the Teleport node.|
|`--[no-]mcp-demo-server`|`false`|Enables the Teleport demo MCP server that shows current user and session information.|
|`-o`, `--output`|`stdout`|Write to stdout with "--output=stdout", default config file with "--output=file" or custom path with --output=file:///path|
|`--proxy`|none|Address of the proxy.|
|`--public-addr`|none|The hostport that the proxy advertises for the HTTP endpoint.|
|`--roles`|none|Comma-separated list of roles to create config with.|
|`--test`|none|Path to a configuration file to test.|
|`--token`|none|Invitation token or path to file with token value to register with an auth server.|
|`--proxy`|*no default*|Address of the proxy.|
|`--public-addr`|*no default*|The hostport that the proxy advertises for the HTTP endpoint.|
|`--roles`|*no default*|Comma-separated list of roles to create config with.|
|`--test`|*no default*|Path to a configuration file to test.|
|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server.|
|`--version`|`v3`|Teleport configuration version.|
## teleport db configure aws create-iam
@@ -187,12 +187,12 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--assumes-roles`|none|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.|
|`--assumes-roles`|*no default*|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.|
|`--name`|`DatabaseAccess`|Created policy name. Defaults to empty. Will be auto-generated if not provided.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--role`|none|IAM role name to attach policy to. Mutually exclusive with --user|
|`-r`, `--types`|none|Comma-separated list of database types to include in the policy. Any of rds,rdsproxy,redshift,redshift-serverless,elasticache,elasticache-serverless,memorydb,keyspace,dynamodb,opensearch,docdb|
|`--user`|none|IAM user name to attach policy to. Mutually exclusive with --role|
|`--role`|*no default*|IAM role name to attach policy to. Mutually exclusive with --user|
|`-r`, `--types`|*no default*|Comma-separated list of database types to include in the policy. Any of rds,rdsproxy,redshift,redshift-serverless,elasticache,elasticache-serverless,memorydb,keyspace,dynamodb,opensearch,docdb|
|`--user`|*no default*|IAM user name to attach policy to. Mutually exclusive with --role|
## teleport db configure aws print-iam
@@ -208,12 +208,12 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--assumes-roles`|none|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.|
|`--assumes-roles`|*no default*|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.|
|`--[no-]policy`|`false`|Only print IAM policy document.|
|`--policy-name`|`DatabaseAccess`|Name of the Teleport Database agent policy. Default: "DatabaseAccess".|
|`--role`|none|IAM role name to attach policy to. Mutually exclusive with --user|
|`-r`, `--types`|none|Comma-separated list of database types to include in the policy. Any of rds,rdsproxy,redshift,redshift-serverless,elasticache,elasticache-serverless,memorydb,keyspace,dynamodb,opensearch,docdb|
|`--user`|none|IAM user name to attach policy to. Mutually exclusive with --role|
|`--role`|*no default*|IAM role name to attach policy to. Mutually exclusive with --user|
|`-r`, `--types`|*no default*|Comma-separated list of database types to include in the policy. Any of rds,rdsproxy,redshift,redshift-serverless,elasticache,elasticache-serverless,memorydb,keyspace,dynamodb,opensearch,docdb|
|`--user`|*no default*|IAM user name to attach policy to. Mutually exclusive with --role|
## teleport db configure bootstrap
@@ -230,9 +230,9 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--assumes-roles`|none|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.|
|`--attach-to-role`|none|Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
|`--attach-to-user`|none|User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
|`--assumes-roles`|*no default*|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.|
|`--attach-to-role`|*no default*|Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
|`--attach-to-user`|*no default*|User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
|`-c`, `--config`|`/etc/teleport.yaml`|Path to a configuration file \[/etc/teleport.yaml\].|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--[no-]manual`|`false`|When executed in "manual" mode, it will print the instructions to complete the configuration instead of applying them directly.|
@@ -252,48 +252,48 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--ad-domain`|none|(Only for SQL Server) Active Directory domain.|
|`--ad-keytab-file`|none|(Only for SQL Server) Kerberos keytab file.|
|`--ad-spn`|none|(Only for SQL Server) Service Principal Name for Active Directory auth.|
|`--aws-account-id`|none|(Only for Keyspaces or DynamoDB) AWS Account ID.|
|`--aws-assume-role-arn`|none|Optional AWS IAM role to assume.|
|`--aws-elasticache-group-id`|none|(Only for ElastiCache) ElastiCache replication group identifier.|
|`--aws-elasticache-serverless-cache-name`|none|(Only for ElastiCache Serverless) ElastiCache Serverless cache name.|
|`--aws-external-id`|none|(Only for AWS-hosted databases) Optional AWS external ID to use when assuming AWS roles.|
|`--aws-memorydb-cluster-name`|none|(Only for MemoryDB) MemoryDB cluster name.|
|`--aws-rds-cluster-id`|none|(Only for RDS Aurora) RDS Aurora database cluster identifier.|
|`--aws-rds-instance-id`|none|(Only for RDS) RDS database instance identifier.|
|`--aws-redshift-cluster-id`|none|(Only for Redshift) Redshift database cluster identifier.|
|`--aws-region`|none|(Only for AWS-hosted databases) AWS region RDS, Aurora, Redshift, Redshift Serverless, ElastiCache, OpenSearch or MemoryDB database instance is running in.|
|`--aws-tags`|none|(Only for AWS discoveries) Comma-separated list of AWS resource tags to match, for example env=dev,dept=it|
|`--azure-mysql-discovery`|none|List of Azure regions in which the agent will discover MySQL servers.|
|`--azure-postgres-discovery`|none|List of Azure regions in which the agent will discover PostgreSQL servers.|
|`--azure-redis-discovery`|none|List of Azure regions in which the agent will discover Azure Cache For Redis servers.|
|`--ad-domain`|*no default*|(Only for SQL Server) Active Directory domain.|
|`--ad-keytab-file`|*no default*|(Only for SQL Server) Kerberos keytab file.|
|`--ad-spn`|*no default*|(Only for SQL Server) Service Principal Name for Active Directory auth.|
|`--aws-account-id`|*no default*|(Only for Keyspaces or DynamoDB) AWS Account ID.|
|`--aws-assume-role-arn`|*no default*|Optional AWS IAM role to assume.|
|`--aws-elasticache-group-id`|*no default*|(Only for ElastiCache) ElastiCache replication group identifier.|
|`--aws-elasticache-serverless-cache-name`|*no default*|(Only for ElastiCache Serverless) ElastiCache Serverless cache name.|
|`--aws-external-id`|*no default*|(Only for AWS-hosted databases) Optional AWS external ID to use when assuming AWS roles.|
|`--aws-memorydb-cluster-name`|*no default*|(Only for MemoryDB) MemoryDB cluster name.|
|`--aws-rds-cluster-id`|*no default*|(Only for RDS Aurora) RDS Aurora database cluster identifier.|
|`--aws-rds-instance-id`|*no default*|(Only for RDS) RDS database instance identifier.|
|`--aws-redshift-cluster-id`|*no default*|(Only for Redshift) Redshift database cluster identifier.|
|`--aws-region`|*no default*|(Only for AWS-hosted databases) AWS region RDS, Aurora, Redshift, Redshift Serverless, ElastiCache, OpenSearch or MemoryDB database instance is running in.|
|`--aws-tags`|*no default*|(Only for AWS discoveries) Comma-separated list of AWS resource tags to match, for example env=dev,dept=it|
|`--azure-mysql-discovery`|*no default*|List of Azure regions in which the agent will discover MySQL servers.|
|`--azure-postgres-discovery`|*no default*|List of Azure regions in which the agent will discover PostgreSQL servers.|
|`--azure-redis-discovery`|*no default*|List of Azure regions in which the agent will discover Azure Cache For Redis servers.|
|`--azure-resource-group`|`*`|List of Azure resource groups for Azure discoveries. Default is "*".|
|`--azure-sqlserver-discovery`|none|List of Azure regions in which the agent will discover Azure SQL Databases and Managed Instances.|
|`--azure-sqlserver-discovery`|*no default*|List of Azure regions in which the agent will discover Azure SQL Databases and Managed Instances.|
|`--azure-subscription`|`*`|List of Azure subscription IDs for Azure discoveries. Default is "*".|
|`--azure-tags`|none|(Only for Azure discoveries) Comma-separated list of Azure resource tags to match, for example env=dev,dept=it|
|`--ca-cert-file`|none|Database CA certificate path.|
|`--ca-pin`|none|CA pin to validate the auth server (can be repeated for multiple pins).|
|`--dynamic-resources-labels`|none|Comma-separated list(s) of labels to match dynamic resources, for example env=dev,dept=it. Required to enable dynamic resources matching.|
|`--elasticache-discovery`|none|List of AWS regions in which the agent will discover ElastiCache Valkey or Redis clusters.|
|`--elasticache-serverless-discovery`|none|List of AWS regions in which the agent will discover ElastiCache Serverless Valkey or Redis caches.|
|`--gcp-instance-id`|none|(Only for Cloud SQL) GCP Cloud SQL instance identifier.|
|`--gcp-project-id`|none|(Only for Cloud SQL) GCP Cloud SQL project identifier.|
|`--labels`|none|Comma-separated list of labels for the database, for example env=dev,dept=it|
|`--memorydb-discovery`|none|List of AWS regions in which the agent will discover MemoryDB clusters.|
|`--name`|none|Name of the proxied database.|
|`--azure-tags`|*no default*|(Only for Azure discoveries) Comma-separated list of Azure resource tags to match, for example env=dev,dept=it|
|`--ca-cert-file`|*no default*|Database CA certificate path.|
|`--ca-pin`|*no default*|CA pin to validate the auth server (can be repeated for multiple pins).|
|`--dynamic-resources-labels`|*no default*|Comma-separated list(s) of labels to match dynamic resources, for example env=dev,dept=it. Required to enable dynamic resources matching.|
|`--elasticache-discovery`|*no default*|List of AWS regions in which the agent will discover ElastiCache Valkey or Redis clusters.|
|`--elasticache-serverless-discovery`|*no default*|List of AWS regions in which the agent will discover ElastiCache Serverless Valkey or Redis caches.|
|`--gcp-instance-id`|*no default*|(Only for Cloud SQL) GCP Cloud SQL instance identifier.|
|`--gcp-project-id`|*no default*|(Only for Cloud SQL) GCP Cloud SQL project identifier.|
|`--labels`|*no default*|Comma-separated list of labels for the database, for example env=dev,dept=it|
|`--memorydb-discovery`|*no default*|List of AWS regions in which the agent will discover MemoryDB clusters.|
|`--name`|*no default*|Name of the proxied database.|
|`--[no-]trust-system-cert-pool`|`false`|Allows Teleport to trust certificate authorities available on the host system for self-hosted databases.|
|`-o`, `--output`|`stdout`|Write to stdout with "--output=stdout", default config file with "--output=file" or custom path with --output=file:///path|
|`--opensearch-discovery`|none|List of AWS regions in which the agent will discover OpenSearch domains.|
|`--protocol`|none|Proxied database protocol. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\].|
|`--opensearch-discovery`|*no default*|List of AWS regions in which the agent will discover OpenSearch domains.|
|`--protocol`|*no default*|Proxied database protocol. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\].|
|`--proxy`|`0.0.0.0:3080`|Teleport proxy address to connect to \[0.0.0.0:3080\].|
|`--rds-discovery`|none|List of AWS regions in which the agent will discover RDS/Aurora instances.|
|`--rdsproxy-discovery`|none|List of AWS regions in which the agent will discover RDS Proxies.|
|`--redshift-discovery`|none|List of AWS regions in which the agent will discover Redshift instances.|
|`--redshift-serverless-discovery`|none|List of AWS regions in which the agent will discover Redshift Serverless instances.|
|`--rds-discovery`|*no default*|List of AWS regions in which the agent will discover RDS/Aurora instances.|
|`--rdsproxy-discovery`|*no default*|List of AWS regions in which the agent will discover RDS Proxies.|
|`--redshift-discovery`|*no default*|List of AWS regions in which the agent will discover Redshift instances.|
|`--redshift-serverless-discovery`|*no default*|List of AWS regions in which the agent will discover Redshift Serverless instances.|
|`--token`|`/tmp/token`|Invitation token or path to file with token value to register with an auth server \[none\].|
|`--uri`|none|Address the proxied database is reachable at.|
|`--uri`|*no default*|Address the proxied database is reachable at.|
## teleport db start
@@ -309,38 +309,48 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--ad-domain`|none|(Only for SQL Server) Active Directory domain.|
|`--ad-keytab-file`|none|(Only for SQL Server) Kerberos keytab file.|
|`--ad-domain`|*no default*|(Only for SQL Server) Active Directory domain.|
|`--ad-keytab-file`|*no default*|(Only for SQL Server) Kerberos keytab file.|
|`--ad-krb5-file`|`/etc/krb5.conf`|(Only for SQL Server) Kerberos krb5.conf file.|
|`--ad-spn`|none|(Only for SQL Server) Service Principal Name for Active Directory auth.|
|`--auth-server`|none|Address of the auth server \[127.0.0.1:3025\].|
|`--aws-account-id`|none|(Only for Keyspaces or DynamoDB) AWS Account ID.|
|`--aws-assume-role-arn`|none|Optional AWS IAM role to assume.|
|`--aws-external-id`|none|Optional AWS external ID used when assuming an AWS role.|
|`--aws-rds-cluster-id`|none|(Only for Aurora) Aurora cluster identifier.|
|`--aws-rds-instance-id`|none|(Only for RDS) RDS instance identifier.|
|`--aws-redshift-cluster-id`|none|(Only for Redshift) Redshift database cluster identifier.|
|`--aws-region`|none|(Only for RDS, Aurora, Redshift, ElastiCache or MemoryDB) AWS region AWS hosted database instance is running in.|
|`--aws-session-tags`|none|(Only for DynamoDB) List of STS tags.|
|`--ca-cert`|none|Database CA certificate path.|
|`--ca-pin`|none|CA pin to validate the auth server (can be repeated for multiple pins).|
|`-c`, `--config`|none|Path to a configuration file \[/etc/teleport.yaml\].|
|`--description`|none|Description of the proxied database.|
|`--diag-addr`|none|Start diagnostic prometheus and healthz endpoint.|
|`--ad-spn`|*no default*|(Only for SQL Server) Service Principal Name for Active Directory auth.|
|`--auth-server`|*no default*|Address of the auth server \[127.0.0.1:3025\].|
|`--aws-account-id`|*no default*|(Only for Keyspaces or DynamoDB) AWS Account ID.|
|`--aws-assume-role-arn`|*no default*|Optional AWS IAM role to assume.|
|`--aws-external-id`|*no default*|Optional AWS external ID used when assuming an AWS role.|
|`--aws-rds-cluster-id`|*no default*|(Only for Aurora) Aurora cluster identifier.|
|`--aws-rds-instance-id`|*no default*|(Only for RDS) RDS instance identifier.|
|`--aws-redshift-cluster-id`|*no default*|(Only for Redshift) Redshift database cluster identifier.|
|`--aws-region`|*no default*|(Only for RDS, Aurora, Redshift, ElastiCache or MemoryDB) AWS region AWS hosted database instance is running in.|
|`--aws-session-tags`|*no default*|(Only for DynamoDB) List of STS tags.|
|`--ca-cert`|*no default*|Database CA certificate path.|
|`--ca-pin`|*no default*|CA pin to validate the auth server (can be repeated for multiple pins).|
|`-c`, `--config`|*no default*|Path to a configuration file \[/etc/teleport.yaml\].|
|`--description`|*no default*|Description of the proxied database.|
|`--diag-addr`|*no default*|Start diagnostic prometheus and healthz endpoint.|
|`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr.|
|`--gcp-alloydb-endpoint-type`|none|(Only for AlloyDB) Endpoint type. One of: \[public private psc\]|
|`--gcp-instance-id`|none|(Only for Cloud SQL) Instance identifier.|
|`--gcp-project-id`|none|(Only for Cloud SQL) Project identifier.|
|`--labels`|none|Comma-separated list of labels for this node, for example env=dev,app=web.|
|`--name`|none|Name of the proxied database.|
|`--gcp-alloydb-endpoint-type`|*no default* (one of: `public`, `private`, `psc`)|(Only for AlloyDB) Endpoint type.|
|`--gcp-instance-id`|*no default*|(Only for Cloud SQL) Instance identifier.|
|`--gcp-project-id`|*no default*|(Only for Cloud SQL) Project identifier.|
|`--labels`|*no default*|Comma-separated list of labels for this node, for example env=dev,app=web.|
|`--name`|*no default*|Name of the proxied database.|
|`--[no-]fips`|`false`|Start Teleport in FedRAMP/FIPS 140 mode.|
|`--[no-]insecure`|`false`|Insecure mode disables certificate validation|
|`--[no-]no-debug-service`|`false`|Disables debug service.|
|`--[no-]skip-version-check`|`false`|Skip version checking between server and client.|
|`--pid-file`|none|Full path to the PID file. By default no PID file will be created.|
|`--protocol`|none|Proxied database protocol. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\].|
|`--token`|none|Invitation token or path to file with token value to register with an auth server \[none\].|
|`--uri`|none|Address the proxied database is reachable at.|
|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created.|
|`--protocol`|*no default*|Proxied database protocol. Supported are: \[postgres mysql mongodb oracle cockroachdb redis snowflake sqlserver cassandra elasticsearch opensearch dynamodb clickhouse clickhouse-http spanner\].|
|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server \[none\].|
|`--uri`|*no default*|Address the proxied database is reachable at.|
## teleport debug check-session-helper
Checks if the embedded session helper is working, if available in this build.
Usage:
```code
$ teleport debug check-session-helper
```
## teleport debug get-log-level
@@ -383,7 +393,7 @@ Arguments:
|Argument|Default|Description|
|---|---|---|
|PROFILES|none (optional)|Comma-separated profile names to be exported. Supported profiles: allocs,block,cmdline,profile,trace,goroutine,heap,mutex,threadcreate. Default: goroutine,heap,profile|
|PROFILES|*no default* (optional)|Comma-separated profile names to be exported. Supported profiles: allocs,block,cmdline,goroutine,heap,mutex,profile,threadcreate,trace. Default: goroutine,heap,profile|
## teleport debug readyz
@@ -395,6 +405,17 @@ Usage:
$ teleport debug readyz
```
## teleport debug require-session-helper
Checks if the embedded session helper is working, failing if not available in
this build.
Usage:
```code
$ teleport debug require-session-helper
```
## teleport debug set-log-level
Changes the log level.
@@ -409,7 +430,7 @@ Arguments:
|Argument|Default|Description|
|---|---|---|
|LEVEL|none (required)|Log level (case-insensitive). Any of: TRACE,DEBUG,INFO,WARN,ERROR|
|LEVEL|*no default* (required)|Log level (case-insensitive). Any of: TRACE,DEBUG,INFO,WARN,ERROR|
## teleport discovery bootstrap
@@ -426,18 +447,18 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--assume-role-arn`|none|Optional AWS IAM role to assume while bootstrapping.|
|`--assumes-roles`|none|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.|
|`--attach-to-role`|none|Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
|`--attach-to-user`|none|User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
|`--assume-role-arn`|*no default*|Optional AWS IAM role to assume while bootstrapping.|
|`--assumes-roles`|*no default*|Comma-separated list of additional IAM roles that the IAM identity should be able to assume. Each role can be either an IAM role ARN or the name of a role in the identity's account.|
|`--attach-to-role`|*no default*|Role name to attach policy to. Mutually exclusive with --attach-to-user. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
|`--attach-to-user`|*no default*|User name to attach policy to. Mutually exclusive with --attach-to-role. If none of the attach-to flags is provided, the command will try to attach the policy to the current user/role based on the credentials.|
|`-c`, `--config`|`/etc/teleport.yaml`|Path to a configuration file \[/etc/teleport.yaml\].|
|`--database-service-policy-name`|`DatabaseAccess`|Name of the policy for bootstrapping database service when database-service-role is provided. |
|`--database-service-role`|none|Role name to attach database access policies to. If specified, bootstrap for the database service that accesses the databases discovered by this discovery service.|
|`--external-id`|none|Optional AWS external ID used when assuming an AWS role.|
|`--database-service-role`|*no default*|Role name to attach database access policies to. If specified, bootstrap for the database service that accesses the databases discovered by this discovery service.|
|`--external-id`|*no default*|Optional AWS external ID used when assuming an AWS role.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--[no-]manual`|`false`|When executed in "manual" mode, it will print the instructions to complete the configuration instead of applying them directly.|
|`--policy-name`|`TeleportEC2Discovery`|Name of the Teleport Discovery service policy. Default: "TeleportEC2Discovery".|
|`--proxy`|none|Teleport proxy address to connect to|
|`--proxy`|*no default*|Teleport proxy address to connect to|
## teleport help
@@ -453,7 +474,7 @@ Arguments:
|Argument|Default|Description|
|---|---|---|
|command|none (optional)|Show help on command.|
|command|*no default* (optional)|Show help on command.|
## teleport install systemd
@@ -473,7 +494,7 @@ Flags:
|`--fd-limit`|`524288`|Maximum number of open file descriptors.|
|`-o`, `--output`|`stdout`|Write to stdout with "--output=stdout" or custom path with --output=file:///path|
|`--pid-file`|`/run/teleport.pid`|Full path to the PID file.|
|`--teleport-path`|none|Full path to the Teleport binary.|
|`--teleport-path`|*no default*|Full path to the Teleport binary.|
## teleport integration configure access-graph aws-iam
@@ -490,13 +511,13 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--aws-account-id`|none|The AWS account ID.|
|`--cloud-trail-bucket`|none|ARN of the S3 bucket where CloudTrail writes events to.|
|`--kms-key`|none|List of KMS Keys used to decrypt SQS and S3 bucket data.|
|`--aws-account-id`|*no default*|The AWS account ID.|
|`--cloud-trail-bucket`|*no default*|ARN of the S3 bucket where CloudTrail writes events to.|
|`--kms-key`|*no default*|List of KMS Keys used to decrypt SQS and S3 bucket data.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--[no-]eks-audit-logs`|`false`|Enable collection of EKS audit logs|
|`--role`|none|The AWS Role used by the AWS OIDC Integration.|
|`--sqs-queue-url`|none|SQS Queue URL used to receive notifications from CloudTrail.|
|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.|
|`--sqs-queue-url`|*no default*|SQS Queue URL used to receive notifications from CloudTrail.|
## teleport integration configure access-graph azure
@@ -513,10 +534,10 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--managed-identity`|none|The ID of the managed identity to run the Discovery service.|
|`--managed-identity`|*no default*|The ID of the managed identity to run the Discovery service.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--role-name`|none|The name of the Azure Role to create and assign to the managed identity|
|`--subscription-id`|none|The subscription ID in which to discovery resources.|
|`--role-name`|*no default*|The name of the Azure Role to create and assign to the managed identity|
|`--subscription-id`|*no default*|The subscription ID in which to discovery resources.|
## teleport integration configure aws-app-access-iam
@@ -532,9 +553,9 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--aws-account-id`|none|The AWS account ID.|
|`--aws-account-id`|*no default*|The AWS account ID.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--role`|none|The AWS Role name used by the AWS OIDC Integration.|
|`--role`|*no default*|The AWS Role name used by the AWS OIDC Integration.|
## teleport integration configure awsoidc-idp
@@ -551,13 +572,13 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--cluster`|none|Teleport Cluster name.|
|`--name`|none|Integration name.|
|`--cluster`|*no default*|Teleport Cluster name.|
|`--name`|*no default*|Integration name.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--[no-]insecure`|`false`|Insecure mode disables certificate validation.|
|`--policy-preset`|none|Policy that will be applied to the AWS OIDC integration role.|
|`--proxy-public-url`|none|Proxy Public URL (eg https://mytenant.teleport.sh).|
|`--role`|none|The AWS Role used by the AWS OIDC Integration.|
|`--policy-preset`|*no default*|Policy that will be applied to the AWS OIDC integration role.|
|`--proxy-public-url`|*no default*|Proxy Public URL (eg https://mytenant.teleport.sh).|
|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.|
## teleport integration configure awsra-trust-anchor
@@ -573,13 +594,13 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--cluster`|none|Teleport Cluster's name.|
|`--name`|none|Integration name.|
|`--cluster`|*no default*|Teleport Cluster's name.|
|`--name`|*no default*|Integration name.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--sync-profile`|none|The AWS IAM Roles Anywhere Profile name to create, which will be used to sync profiles as apps.|
|`--sync-role`|none|The AWS IAM Role name to create, which will be used to sync profiles as apps.|
|`--trust-anchor`|none|AWS Roles Anywhere Trust Anchor name.|
|`--trust-anchor-cert-b64`|none|AWS Roles Anywhere Trust Anchor's certificate, encoded in base64.|
|`--sync-profile`|*no default*|The AWS IAM Roles Anywhere Profile name to create, which will be used to sync profiles as apps.|
|`--sync-role`|*no default*|The AWS IAM Role name to create, which will be used to sync profiles as apps.|
|`--trust-anchor`|*no default*|AWS Roles Anywhere Trust Anchor name.|
|`--trust-anchor-cert-b64`|*no default*|AWS Roles Anywhere Trust Anchor's certificate, encoded in base64.|
## teleport integration configure azure-oidc
@@ -595,10 +616,10 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--auth-connector-name`|none|The name of Entra ID SAML Auth connector in Teleport.|
|`--auth-connector-name`|*no default*|The name of Entra ID SAML Auth connector in Teleport.|
|`--[no-]access-graph`|`false`|Enable Access Graph integration.|
|`--[no-]skip-oidc-integration`|`false`|Skip OIDC integration.|
|`--proxy-public-addr`|none|The public address of Teleport Proxy Service|
|`--proxy-public-addr`|*no default*|The public address of Teleport Proxy Service|
## teleport integration configure deployservice-iam
@@ -614,13 +635,13 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--aws-account-id`|none|The AWS account ID.|
|`--aws-region`|none|AWS Region.|
|`--cluster`|none|Teleport Cluster's name.|
|`--name`|none|Integration name.|
|`--aws-account-id`|*no default*|The AWS account ID.|
|`--aws-region`|*no default*|AWS Region.|
|`--cluster`|*no default*|Teleport Cluster's name.|
|`--name`|*no default*|Integration name.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--role`|none|The AWS Role used by the AWS OIDC Integration.|
|`--task-role`|none|The AWS Role to be used by the deployed service.|
|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.|
|`--task-role`|*no default*|The AWS Role to be used by the deployed service.|
## teleport integration configure ec2-ssm-iam
@@ -637,14 +658,14 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--aws-account-id`|none|The AWS account ID.|
|`--aws-region`|none|AWS Region.|
|`--cluster`|none|Teleport Cluster's name.|
|`--name`|none|Integration name.|
|`--aws-account-id`|*no default*|The AWS account ID.|
|`--aws-region`|*no default*|AWS Region.|
|`--cluster`|*no default*|Teleport Cluster's name.|
|`--name`|*no default*|Integration name.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--proxy-public-url`|none|Proxy Public URL (eg https://mytenant.teleport.sh).|
|`--role`|none|The AWS Role name used by the AWS OIDC Integration.|
|`--ssm-document-name`|none|The AWS SSM Document name to create that will be used to install teleport.|
|`--proxy-public-url`|*no default*|Proxy Public URL (eg https://mytenant.teleport.sh).|
|`--role`|*no default*|The AWS Role name used by the AWS OIDC Integration.|
|`--ssm-document-name`|*no default*|The AWS SSM Document name to create that will be used to install teleport.|
## teleport integration configure eks-iam
@@ -660,10 +681,10 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--aws-account-id`|none|The AWS account ID.|
|`--aws-region`|none|AWS Region.|
|`--aws-account-id`|*no default*|The AWS account ID.|
|`--aws-region`|*no default*|AWS Region.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--role`|none|The AWS Role used by the AWS OIDC Integration.|
|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.|
## teleport integration configure externalauditstorage
@@ -680,20 +701,20 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--athena-results`|none|The S3 URI where athena results are stored.|
|`--athena-workgroup`|none|The name of the Athena workgroup used.|
|`--audit-events`|none|The S3 URI where audit events are stored.|
|`--aws-account-id`|none|The AWS account ID.|
|`--athena-results`|*no default*|The S3 URI where athena results are stored.|
|`--athena-workgroup`|*no default*|The name of the Athena workgroup used.|
|`--audit-events`|*no default*|The S3 URI where audit events are stored.|
|`--aws-account-id`|*no default*|The AWS account ID.|
|`--aws-partition`|`aws`|AWS partition (default: aws).|
|`--aws-region`|none|AWS region.|
|`--cluster-name`|none|Teleport Cluster name.|
|`--glue-database`|none|The name of the Glue database used.|
|`--glue-table`|none|The name of the Glue table used.|
|`--integration`|none|AWS OIDC Integration name.|
|`--aws-region`|*no default*|AWS region.|
|`--cluster-name`|*no default*|Teleport Cluster name.|
|`--glue-database`|*no default*|The name of the Glue database used.|
|`--glue-table`|*no default*|The name of the Glue table used.|
|`--integration`|*no default*|AWS OIDC Integration name.|
|`--[no-]bootstrap`|`false`|Bootstrap required infrastructure.|
|`--policy`|none|The name for the Policy to attach to the IAM role.|
|`--role`|none|The IAM Role used by the AWS OIDC Integration.|
|`--session-recordings`|none|The S3 URI where session recordings are stored.|
|`--policy`|*no default*|The name for the Policy to attach to the IAM role.|
|`--role`|*no default*|The IAM Role used by the AWS OIDC Integration.|
|`--session-recordings`|*no default*|The S3 URI where session recordings are stored.|
## teleport integration configure listdatabases-iam
@@ -709,10 +730,10 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--aws-account-id`|none|The AWS account ID.|
|`--aws-region`|none|AWS Region.|
|`--aws-account-id`|*no default*|The AWS account ID.|
|`--aws-region`|*no default*|AWS Region.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--role`|none|The AWS Role used by the AWS OIDC Integration.|
|`--role`|*no default*|The AWS Role used by the AWS OIDC Integration.|
## teleport integration configure samlidp gcp-workforce
@@ -728,10 +749,10 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--idp-metadata-url`|none|Teleport SAML IdP metadata endpoint.|
|`--org-id`|none|GCP organization ID.|
|`--pool-name`|none|Name for the new workforce identity pool.|
|`--pool-provider-name`|none|Name for the new workforce identity pool provider.|
|`--idp-metadata-url`|*no default*|Teleport SAML IdP metadata endpoint.|
|`--org-id`|*no default*|GCP organization ID.|
|`--pool-name`|*no default*|Name for the new workforce identity pool.|
|`--pool-provider-name`|*no default*|Name for the new workforce identity pool provider.|
## teleport integration configure session-summaries bedrock
@@ -748,10 +769,10 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--aws-account-id`|none|The AWS account ID.|
|`--aws-account-id`|*no default*|The AWS account ID.|
|`--[no-]confirm`|`false`|Apply changes without confirmation prompt.|
|`--resource`|`*`|The Amazon Bedrock resource to grant access to. Can be a full ARN or a model ID (e.g., 'anthropic.claude-v2' or '*' for all models).|
|`--role`|none|The AWS Role name used by the AWS OIDC Integration.|
|`--role`|*no default*|The AWS Role name used by the AWS OIDC Integration.|
## teleport join openssh
@@ -767,20 +788,20 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--additional-principals`|none|Additional principal to include, can be specified multiple times.|
|`--address`|none|Hostname or IP address of this OpenSSH node.|
|`--additional-principals`|*no default*|Additional principal to include, can be specified multiple times.|
|`--address`|*no default*|Hostname or IP address of this OpenSSH node.|
|`--data-dir`|`/var/lib/teleport`|Path to directory to store teleport data \[/var/lib/teleport\].|
|`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr.|
|`--join-method`|none|Method to use to join the cluster (token, iam, ec2).|
|`--labels`|none|Comma-separated list of labels for this OpenSSH node, for example env=dev,app=web.|
|`--join-method`|*no default* (one of: `token`, `iam`, `ec2`)|Method to use to join the cluster.|
|`--labels`|*no default*|Comma-separated list of labels for this OpenSSH node, for example env=dev,app=web.|
|`--[no-]insecure`|`false`|Insecure mode disables certificate validation.|
|`--[no-]restart-sshd`|`true`|Restart OpenSSH.|
|`--[no-]skip-version-check`|`false`|Skip version checking between server and client.|
|`--openssh-config`|`/etc/ssh/sshd_config`|Path to the OpenSSH config file \[/etc/ssh/sshd_config\].|
|`--proxy-server`|none|Address of the proxy server.|
|`--proxy-server`|*no default*|Address of the proxy server.|
|`--sshd-check-command`|`sshd -t -f`|Command to use when checking OpenSSH config for validity. (sshd -t -f \<sshd_config\>)|
|`--sshd-restart-command`|none|Command to use when restarting openssh.|
|`--token`|none|Invitation token or path to file with token value to register with an auth server.|
|`--sshd-restart-command`|*no default*|Command to use when restarting openssh.|
|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server.|
## teleport node configure
@@ -796,19 +817,19 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--auth-server`|none|Address of the auth server.|
|`--azure-client-id`|none|Sets the client ID of the managed identity to join with. Only applies to the 'azure' join method.|
|`--ca-pin`|none|Comma-separated list of SKPI hashes for the CA used to verify the auth server.|
|`--cluster-name`|none|Unique cluster name, e.g. example.com.|
|`--auth-server`|*no default*|Address of the auth server.|
|`--azure-client-id`|*no default*|Sets the client ID of the managed identity to join with. Only applies to the 'azure' join method.|
|`--ca-pin`|*no default*|Comma-separated list of SKPI hashes for the CA used to verify the auth server.|
|`--cluster-name`|*no default*|Unique cluster name, e.g. example.com.|
|`--data-dir`|`/var/lib/teleport`|Path to a directory where Teleport keep its data.|
|`--join-method`|`token`|Method to use to join the cluster (azure, azure_devops, bitbucket, circleci, ec2, gcp, github, gitlab, iam, kubernetes, spacelift, token, tpm, terraform_cloud, oracle, bound_keypair, env0)|
|`--labels`|none|Comma-separated list of labels to add to newly created nodes ex) env=staging,cloud=aws.|
|`--node-name`|none|Name for the Teleport node.|
|`--join-method`|`token` (one of: `azure`, `azure_devops`, `bitbucket`, `circleci`, `ec2`, `gcp`, `github`, `gitlab`, `iam`, `kubernetes`, `spacelift`, `token`, `tpm`, `terraform_cloud`, `oracle`, `bound_keypair`, `env0`)|Method to use to join the cluster.|
|`--labels`|*no default*|Comma-separated list of labels to add to newly created nodes ex) env=staging,cloud=aws.|
|`--node-name`|*no default*|Name for the Teleport node.|
|`--[no-]silent`|`false`|Suppress user hint message.|
|`-o`, `--output`|`stdout`|Write to stdout with "--output=stdout", default config file with "--output=file" or custom path with --output=file:///path|
|`--proxy`|none|Address of the proxy server.|
|`--public-addr`|none|The hostport that the node advertises for the SSH endpoint.|
|`--token`|none|Invitation token or path to file with token value to register with an auth server.|
|`--proxy`|*no default*|Address of the proxy server.|
|`--public-addr`|*no default*|The hostport that the node advertises for the SSH endpoint.|
|`--token`|*no default*|Invitation token or path to file with token value to register with an auth server.|
|`--version`|`v3`|Teleport configuration version.|
## teleport start
@@ -825,27 +846,27 @@ Flags:
|Flag|Default|Description|
|---|---|---|
|`--advertise-ip`|none|IP to advertise to clients if running behind NAT|
|`--apply-on-startup`|none|Path to a non-empty YAML file containing resources to apply on startup. Works on initialized clusters, unlike --bootstrap. Only supports the following kinds: \[user token cluster_networking_config cluster_auth_preference bot role, workload_identity\].|
|`--auth-server`|none|Address of the auth server \[127.0.0.1:3025\]|
|`--bootstrap`|none|Path to a non-empty YAML file containing bootstrap resources (ignored if already initialized)|
|`--ca-pin`|none|CA pin to validate the Auth Server (can be repeated for multiple pins)|
|`-c`, `--config`|none|Path to a configuration file \[/etc/teleport.yaml\]|
|`--diag-addr`|none|Start diagnostic prometheus and healthz endpoint.|
|`--advertise-ip`|*no default*|IP to advertise to clients if running behind NAT|
|`--apply-on-startup`|*no default*|Path to a non-empty YAML file containing resources to apply on startup. Works on initialized clusters, unlike --bootstrap. Only supports the following kinds: bot,cluster_auth_preference,cluster_networking_config,inference_model,inference_policy,inference_secret,retrieval_model,role,token,user,workload_identity.|
|`--auth-server`|*no default*|Address of the auth server \[127.0.0.1:3025\]|
|`--bootstrap`|*no default*|Path to a non-empty YAML file containing bootstrap resources (ignored if already initialized)|
|`--ca-pin`|*no default*|CA pin to validate the Auth Server (can be repeated for multiple pins)|
|`-c`, `--config`|*no default*|Path to a configuration file \[/etc/teleport.yaml\]|
|`--diag-addr`|*no default*|Start diagnostic prometheus and healthz endpoint.|
|`-d`, `--[no-]debug`|`false`|Enable verbose logging to stderr|
|`--labels`|none|Comma-separated list of labels for this node, for example env=dev,app=web|
|`-l`, `--listen-ip`|none|IP address to bind to \[0.0.0.0\]|
|`--nodename`|none|Name of this node, defaults to hostname|
|`--labels`|*no default*|Comma-separated list of labels for this node, for example env=dev,app=web|
|`-l`, `--listen-ip`|*no default*|IP address to bind to \[0.0.0.0\]|
|`--nodename`|*no default*|Name of this node, defaults to hostname|
|`--[no-]fips`|`false`|Start Teleport in FedRAMP/FIPS 140 mode.|
|`--[no-]insecure`|`false`|Insecure mode disables certificate validation|
|`--[no-]insecure-no-tls`|`false`|Disable TLS for the web socket|
|`--[no-]no-debug-service`|`false`|Disables debug service.|
|`--[no-]permit-user-env`|`false`|Enables reading of ~/.tsh/environment when creating a session|
|`--[no-]skip-version-check`|`false`|Skip version checking between server and client.|
|`--pid-file`|none|Full path to the PID file. By default no PID file will be created|
|`-r`, `--roles`|none|Comma-separated list of roles to start with \[proxy,node,auth,app,db\]|
|`--token`|none|Invitation token or path to file with token value. Used to register with an auth server \[none\]|
|`--token-secret`|none|Invitation token secret or path to file with secret value. Used to register with an auth server \[none\]|
|`--pid-file`|*no default*|Full path to the PID file. By default no PID file will be created|
|`-r`, `--roles`|*no default*|Comma-separated list of roles to start with \[proxy,node,auth,app,db\]|
|`--token`|*no default*|Invitation token or path to file with token value. Used to register with an auth server \[none\]|
|`--token-secret`|*no default*|Invitation token secret or path to file with secret value. Used to register with an auth server \[none\]|
## teleport status
docs/pages/reference/cli/tsh.mdx
+442 -270
View File
File diff suppressed because it is too large Load Diff
go.mod
+1 -1
View File
@@ -626,7 +626,7 @@ require (
// when changing the replace directives make sure to also apply the same changes
// to modules that require github.com/gravitational/teleport
replace (
github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20260417152838-9efcbe7e5d61
github.com/alecthomas/kingpin/v2 => github.com/gravitational/kingpin/v2 v2.1.11-0.20260507144047-1f18894764f5
github.com/crewjam/saml => github.com/gravitational/saml v0.4.15-teleport.2
github.com/datastax/go-cassandra-native-protocol => github.com/gravitational/go-cassandra-native-protocol v0.0.0-teleport.3
github.com/go-mysql-org/go-mysql => github.com/gravitational/go-mysql v1.9.1-teleport.4
go.sum
+2 -2
View File
@@ -789,8 +789,8 @@ github.com/gravitational/go-mysql v1.9.1-teleport.4 h1:2Lt2fcEMrco6apu8jme0mj6OS
github.com/gravitational/go-mysql v1.9.1-teleport.4/go.mod h1:pkllauQtJgHr2mTonYYysOznctozxiWgwpKAez0s+2U=
github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5 h1:qg8FcGwRACSHortU1UxCSo9nF0t34rPWjk9Nef3j2Ic=
github.com/gravitational/httprouter v1.3.1-0.20220408074523-c876c5e705a5/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
github.com/gravitational/kingpin/v2 v2.1.11-0.20260417152838-9efcbe7e5d61 h1:cgG/o1SAL2WK9AtryT/esiuXqCN47f15EwppKgeom60=
github.com/gravitational/kingpin/v2 v2.1.11-0.20260417152838-9efcbe7e5d61/go.mod h1:usbNrkVhUGh5+Pqd4u5tYKszWmq6YSCApkePRMmJFP8=
github.com/gravitational/kingpin/v2 v2.1.11-0.20260507144047-1f18894764f5 h1:E7lyOeBLDh+3N3cAKT+dC343tAP5uJxyUJDGFxi+q5Y=
github.com/gravitational/kingpin/v2 v2.1.11-0.20260507144047-1f18894764f5/go.mod h1:usbNrkVhUGh5+Pqd4u5tYKszWmq6YSCApkePRMmJFP8=
github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1 h1:Kt7aT9N7vbZmcMejGXnSAGap8TUwH3fMoHE8cQm14wc=
github.com/gravitational/license v0.0.0-20250329001817-070456fa8ec1/go.mod h1:n4RXV6T3SJ/vrJqmc4vBeHpaBspxWENDD67ssQlXXkg=
github.com/gravitational/predicate v1.3.4 h1:9N3JhBXNPcUh0w8DdlpnVmfnH9Z3xxbw43sD3E19VBE=
lib/auth/init.go
+9 -3
View File
@@ -1788,8 +1788,12 @@ func migrateRemoteClusters(ctx context.Context, asrv *Server) error {
// to avoid consistency issues. A lower priority means the resource is applied
// before.
var ResourceApplyPriority = map[string]int{
types.KindRole: 1,
types.KindUser: 2, // Users must be applied after Roles
types.KindRole: 1,
types.KindInferenceSecret: 1,
types.KindUser: 2, // Users must be applied after Roles
types.KindInferenceModel: 2,
types.KindToken: 3,
types.KindClusterNetworkingConfig: 3,
types.KindClusterAuthPreference: 3,
@@ -1797,7 +1801,9 @@ var ResourceApplyPriority = map[string]int{
// Bots should be applied after users and roles as at the moment they are actually converted to users and roles.
// This will ensure that Bot Users/Roles are properly created regardless of the Teleport version from which the
// resources have been exported.
types.KindBot: 3,
types.KindBot: 3,
types.KindInferencePolicy: 3,
types.KindRetrievalModel: 3,
}
// Unlike when resources are loaded via --bootstrap, we're inserting elements via their service.
lib/tbot/cli/keypair_create.go
+1 -1
View File
@@ -56,7 +56,7 @@ func NewKeypairCreateCommand(parentCmd KingpinClause, action func(*KeypairCreate
cmd.Flag("storage", "The internal storage URI to write the keypair to, such as `file:///var/lib/teleport/bot`.").StringVar(&c.Storage)
cmd.Flag("proxy-server", "The proxy server, which will be pinged to determine the current cryptographic suite in use.").Required().StringVar(&c.ProxyServer)
cmd.Flag("overwrite", "If set, overwrite any existing keypair. If unset and a keypair already exists, its key will be printed for use.").BoolVar(&c.Overwrite)
cmd.Flag("format", "Output format, one of: text, json").Default(teleport.Text).EnumVar(&c.Format, teleport.Text, teleport.JSON)
cmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.Format, teleport.Text, teleport.JSON)
cmd.Flag("static", "If set, creates a static private key instead of writing a mutable key into bot storage. If --static-key-path is unset, the key will be printed to the terminal.").BoolVar(&c.Static)
cmd.Flag("static-key-path", "If set, writes the static private key to a file.").StringVar(&c.StaticKeyPath)
lib/tbot/cli/start_database.go
+1 -1
View File
@@ -52,7 +52,7 @@ func NewDatabaseCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode
c.sharedDestinationArgs = newSharedDestinationArgs(cmd)
c.genericMutatorHandler = newGenericMutatorHandler(cmd, c, action)
cmd.Flag("format", "The format of the credentials to generate. If specified, must be `tls`, `mongo` or `cockroach`.").Default("").EnumVar(&c.Format, database.SupportedDatabaseFormatStrings()...)
cmd.Flag("format", "The format of the credentials to generate.").Default("").EnumVar(&c.Format, database.SupportedDatabaseFormatStrings()...)
cmd.Flag("service", "The database service name.").Required().StringVar(&c.Service)
cmd.Flag("username", "The database user name.").Required().StringVar(&c.Username)
cmd.Flag("database", "The name of the database available in the requested database service.").Required().StringVar(&c.Database)
lib/tbot/cli/start_legacy.go
+1 -7
View File
@@ -23,7 +23,6 @@ import (
"fmt"
"log/slog"
"reflect"
"strings"
"time"
"github.com/alecthomas/kingpin/v2"
@@ -150,11 +149,6 @@ type LegacyCommand struct {
// NewLegacyCommand initializes and returns a command supporting
// `tbot start legacy` and `tbot configure legacy`.
func NewLegacyCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode CommandMode) *LegacyCommand {
joinMethodList := fmt.Sprintf(
"(%s)",
strings.Join(onboarding.SupportedJoinMethods, ", "),
)
c := &LegacyCommand{
action: action,
cmd: parentCmd.Command("legacy", fmt.Sprintf("%s tbot with either a config file or a legacy output.", mode)).Default(),
@@ -167,7 +161,7 @@ func NewLegacyCommand(parentCmd *kingpin.CmdClause, action MutatorAction, mode C
c.cmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&c.CAPins)
c.cmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").DurationVar(&c.CertificateTTL)
c.cmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&c.RenewalInterval)
c.cmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&c.JoinMethod, onboarding.SupportedJoinMethods...)
c.cmd.Flag("join-method", "Method to use to join the cluster.").EnumVar(&c.JoinMethod, onboarding.SupportedJoinMethods...)
c.cmd.Flag("oneshot", "If set, quit after the first renewal.").IsSetByUser(&c.oneshotSetByUser).BoolVar(&c.Oneshot)
c.cmd.Flag("diag-addr", "If set and the bot is in debug mode, a diagnostics service will listen on specified address.").StringVar(&c.DiagAddr)
c.cmd.Flag("diag-socket-for-updater", "If set, run the diagnostics service on the specified socket path for teleport-update to consume.").Hidden().StringVar(&c.DiagSocketForUpdater)
lib/tbot/cli/start_shared.go
+1 -7
View File
@@ -20,10 +20,8 @@ package cli
import (
"context"
"fmt"
"log/slog"
"reflect"
"strings"
"time"
"github.com/alecthomas/kingpin/v2"
@@ -137,15 +135,11 @@ func newSharedStartArgs(cmd *kingpin.CmdClause) *sharedStartArgs {
args := &sharedStartArgs{}
args.AuthProxyArgs = newAuthProxyArgs(cmd)
joinMethodList := fmt.Sprintf(
"(%s)",
strings.Join(onboarding.SupportedJoinMethods, ", "),
)
cmd.Flag("token", "A bot join token or path to file with token value, if attempting to onboard a new bot; used on first connect.").Envar(TokenEnvVar).StringVar(&args.Token)
cmd.Flag("ca-pin", "CA pin to validate the Teleport Auth Server; used on first connect.").StringsVar(&args.CAPins)
cmd.Flag("certificate-ttl", "TTL of short-lived machine certificates.").DurationVar(&args.CertificateTTL)
cmd.Flag("renewal-interval", "Interval at which short-lived certificates are renewed; must be less than the certificate TTL.").DurationVar(&args.RenewalInterval)
cmd.Flag("join-method", "Method to use to join the cluster. "+joinMethodList).EnumVar(&args.JoinMethod, onboarding.SupportedJoinMethods...)
cmd.Flag("join-method", "Method to use to join the cluster.").EnumVar(&args.JoinMethod, onboarding.SupportedJoinMethods...)
cmd.Flag("oneshot", "If set, quit after the first renewal.").IsSetByUser(&args.oneshotSetByUser).BoolVar(&args.Oneshot)
cmd.Flag("diag-addr", "If set and the bot is in debug mode, a diagnostics service will listen on specified address.").StringVar(&args.DiagAddr)
cmd.Flag("storage", "A destination URI for tbot's internal storage, e.g. file:///foo/bar").StringVar(&args.Storage)
lib/utils/usage.go
+3
View File
@@ -25,3 +25,6 @@ import (
// UpdateAppUsageTemplate is a no-op for regular builds. See usage_docs.go for
// doc generation.
func UpdateAppUsageTemplate(*kingpin.Application) {}
// DocsMode is false in regular builds. It is true when building with -tags docs.
const DocsMode = false
lib/utils/usage_docs.go
+62 -5
View File
@@ -34,6 +34,9 @@ import (
"gopkg.in/yaml.v3"
)
// DocsMode is true when building with -tags docs.
const DocsMode = true
var nonLetters = regexp.MustCompile(`\W`)
// lowerWordChars returns only the word characters (\w) from in, in lowercase,
@@ -183,22 +186,37 @@ func sortCommandsByName(cmds []*kingpin.CmdModel) []*kingpin.CmdModel {
return cmds
}
const noDefaultSet = "*no default*"
// formatDefaultFlagValue returns the default value of flag to display in a
// table of flags. Assumes that a Boolean flag is false unless it is true by
// default.
// default. If the flag is an enum, includes the valid enum options.
func formatDefaultFlagValue(flag *kingpin.FlagModel) string {
var defaultValue string
switch {
case len(flag.Default) == 0 && flag.IsBoolFlag():
return "`false`"
defaultValue = "`false`"
case len(flag.Default) > 0:
ret := make([]string, len(flag.Default))
for i, v := range flag.Default {
ret[i] = fmt.Sprintf("`%v`", v)
}
return strings.Join(ret, ",")
defaultValue = strings.Join(ret, ",")
default:
return "none"
defaultValue = noDefaultSet
}
// If this is an enum flag, append the valid options
if prefix, options := getEnumOptions(flag.Value); len(options) > 0 {
optionsFormatted := make([]string, len(options))
for i, opt := range options {
optionsFormatted[i] = fmt.Sprintf("`%s`", opt)
}
defaultValue += fmt.Sprintf(" (%s: %s)", prefix, strings.Join(optionsFormatted, ", "))
}
return defaultValue
}
// formatDefaultArgValue returns the default value of arg to display in a table
@@ -212,7 +230,7 @@ func formatDefaultArgValue(arg *kingpin.ArgModel) string {
}
ret = strings.Join(def, ",")
} else {
ret = "none"
ret = noDefaultSet
}
if arg.Required {
ret += " (required)"
@@ -229,6 +247,45 @@ type repeatableFlag interface {
IsCumulative() bool
}
// enumFlag is an interface for flags that have enum values. We use reflection
// to access the options field since kingpin doesn't export an interface for this.
type enumFlag interface {
String() string
Set(string) error
}
// Optional interface for flags that can be repeated.
type repeatable interface {
IsCumulative() bool
}
// Optional interface for enum values that have a set of valid options.
type enumOptions interface {
EnumOptions() []string
}
// getEnumOptions extracts the enum options from a kingpin Value using reflection.
// Returns nil if the value is not an enum type or if options cannot be extracted.
func getEnumOptions(value kingpin.Value) (string, []string) {
if value == nil {
return "", nil
}
prefix := "one of"
if e, ok := value.(repeatable); ok && e.IsCumulative() {
prefix = "any of (repeatable)"
}
var options []string
if e, ok := value.(enumOptions); ok {
options = e.EnumOptions()
}
if len(options) > 0 {
return prefix, options
}
return "", nil
}
// formatUsageArg prints a command argument to include in a usage snippet.
func formatUsageArg(arg *kingpin.ArgModel) string {
var ret string
lib/utils/usage_docs_test.go
+49
View File
@@ -512,6 +512,55 @@ Arguments:
|start_time|@now@ (optional)|When to start the app|
|verbosity|@3@ (optional)|Verbosity level.|
`,
},
{
name: "enum flag with default value",
makeApp: func() *kingpin.Application {
app := InitCLIParser("myapp", "This is the main CLI tool.")
var format string
app.Flag("format", "Output format").Default("text").EnumVar(&format, "text", "json", "yaml")
return app
},
config: generatorConfig{
Introduction: "This is the main CLI tool.",
},
expectSubstring: `Global flags:
|Flag|Default|Description|
|---|---|---|
|@--format@|@text@ (valid: @text@, @json@, @yaml@)|Output format|
`,
},
{
name: "enum flag in subcommand",
makeApp: func() *kingpin.Application {
app := InitCLIParser("myapp", "This is the main CLI tool.")
list := app.Command("list", "List resources.")
var mode string
list.Flag("mode", "List mode").Default("all").EnumVar(&mode, "all", "active", "inactive")
return app
},
config: generatorConfig{
Introduction: "This is the main CLI tool.",
},
expectSubstring: `## myapp list
List resources.
Usage:
@@@code
$ myapp list [<flags>]
@@@
Flags:
|Flag|Default|Description|
|---|---|---|
|@--mode@|@all@ (valid: @all@, @active@, @inactive@)|List mode|
`,
},
}
tool/tctl/common/acl_command.go
+6 -6
View File
@@ -89,16 +89,16 @@ func (c *ACLCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFl
acl := app.Command("acl", "Manage Access Lists.").Alias("access-lists")
c.ls = acl.Command("ls", "List cluster Access Lists.")
c.ls.Flag("format", "Output format, 'yaml', 'json', or 'text'").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text)
c.ls.Flag("format", "Output format.").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text)
c.ls.Flag("review-only", "List only access lists that are due for review within the next 2 weeks or past due").BoolVar(&c.reviewOnly)
c.get = acl.Command("get", "Get detailed information for an Access List.")
c.get.Arg("access-list-name", "The Access List name.").Required().StringVar(&c.accessListName)
c.get.Flag("format", "Output format, 'yaml', 'json', or 'text'").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text)
c.get.Flag("format", "Output format.").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text)
c.summary = acl.Command("summary", "Show summary information for access lists, including their members and last review.")
c.summary.Arg("access-list-name", "The access list name to show summary for. If not provided, shows summary for all access lists.").StringVar(&c.accessListName)
c.summary.Flag("format", "Output format 'yaml' or 'json'").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON)
c.summary.Flag("format", "Output format.").Default(teleport.YAML).EnumVar(&c.format, teleport.YAML, teleport.JSON)
c.summary.Flag("review-only", "Show only access lists that are due for review within the next 2 weeks or past due. Defaults to true.").
Default("true"). // default to show only reviewable lists since the command can get expensive with many lists/members
BoolVar(&c.reviewOnly)
@@ -106,7 +106,7 @@ func (c *ACLCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFl
users := acl.Command("users", "Manage user membership to Access Lists.")
c.usersAdd = users.Command("add", "Add a user to an Access List.")
c.usersAdd.Flag("kind", "Access list member kind, 'user' or 'list'").Default(memberKindUser).EnumVar(&c.memberKind, memberKindUser, memberKindList)
c.usersAdd.Flag("kind", "Access list member kind.").Default(memberKindUser).EnumVar(&c.memberKind, memberKindUser, memberKindList)
c.usersAdd.Arg("access-list-name", "The Access List name.").Required().StringVar(&c.accessListName)
c.usersAdd.Arg("user", "The user to add to the Access List.").Required().StringVar(&c.userName)
c.usersAdd.Arg("expires", "When the user's access expires (must be in RFC3339). Defaults to the expiration time of the Access List.").StringVar(&c.expires)
@@ -118,7 +118,7 @@ func (c *ACLCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFl
c.usersList = users.Command("ls", "List users that are members of an Access List.")
c.usersList.Arg("access-list-name", "The Access List name.").Required().StringVar(&c.accessListName)
c.usersList.Flag("format", "Output format 'json', or 'text'").Default(teleport.Text).EnumVar(&c.format, teleport.JSON, teleport.Text)
c.usersList.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, teleport.JSON, teleport.Text)
reviews := acl.Command("reviews", "Manage access list reviews.")
@@ -129,7 +129,7 @@ func (c *ACLCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIFl
c.reviewsList = reviews.Command("ls", "List past audit history for a given access list.")
c.reviewsList.Arg("access-list-name", "The access list name to fetch review history for.").Required().StringVar(&c.accessListName)
c.reviewsList.Flag("format", "Output format 'yaml', 'json', or 'text'").Default(teleport.Text).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text)
c.reviewsList.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, teleport.YAML, teleport.JSON, teleport.Text)
if c.Stdout == nil {
c.Stdout = os.Stdout
tool/tctl/common/alert_command.go
+3 -3
View File
@@ -80,12 +80,12 @@ func (c *AlertCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLI
c.alertList = alert.Command("list", "List cluster alerts.").Alias("ls")
c.alertList.Flag("verbose", "Show detailed alert info, including acknowledged alerts.").Short('v').BoolVar(&c.verbose)
c.alertList.Flag("labels", labelHelp).StringVar(&c.labels)
c.alertList.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.format, formats...)
c.alertList.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, formats...)
c.alertCreate = alert.Command("create", "Create cluster alerts.")
c.alertCreate.Arg("message", "Alert body message.").Required().StringVar(&c.message)
c.alertCreate.Flag("ttl", "Time duration after which the alert expires (default 24h).").DurationVar(&c.ttl)
c.alertCreate.Flag("severity", "Severity of the alert (low, medium, or high).").Default("low").EnumVar(&c.severity, "low", "medium", "high")
c.alertCreate.Flag("severity", "Severity of the alert.").Default("low").EnumVar(&c.severity, "low", "medium", "high")
c.alertCreate.Flag("labels", "List of labels to attach to the alert. For example: key1=value1,key2=value2.").StringVar(&c.labels)
c.alertDelete = alert.Command("delete", "Deletes a cluster alert.").Alias("rm")
@@ -99,7 +99,7 @@ func (c *AlertCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLI
c.alertAck.Flag("clear", "Clear the acknowledgment for the cluster alert.").BoolVar(&c.clear)
c.alertAck.Flag("reason", "The reason for acknowledging the cluster alert.").StringVar(&c.reason)
c.alertAck.Arg("id", "The cluster alert ID.").Required().StringVar(&c.alertID)
c.alertAck.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.format, formats...)
c.alertAck.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, formats...)
// We add "ack ls" as a command so kingpin shows it in the help dialog - as there is a space, `tctl ack xyz` will always be
// handled by the ack command above
tool/tctl/common/auth_command.go
+1 -1
View File
@@ -176,7 +176,7 @@ func (a *AuthCommand) Initialize(app *kingpin.Application, cliFlags *tctlcfg.Glo
a.authLS.Flag("format", "Output format: 'yaml', 'json' or 'text'").Default(teleport.YAML).StringVar(&a.format)
a.authCRL = auth.Command("crl", "Export empty certificate revocation list (CRL) for Teleport certificate authorities.")
a.authCRL.Flag("type", fmt.Sprintf("Certificate authority type, one of: %s", strings.Join(allowedCRLCertificateTypes, ", "))).Required().EnumVar(&a.caType, allowedCRLCertificateTypes...)
a.authCRL.Flag("type", "Certificate authority type.").Required().EnumVar(&a.caType, allowedCRLCertificateTypes...)
a.authCRL.Flag("out", "If set, writes exported revocation lists to files with the given path prefix").StringVar(&a.output)
if libsubca.Enabled() {
tool/tctl/common/auth_rotate_command.go
+1 -1
View File
@@ -72,7 +72,7 @@ func (c *authRotateCommand) Initialize(authCmd *kingpin.CmdClause) {
c.cmd = authCmd.Command("rotate", "Rotate certificate authorities in the cluster. Starts in interactive mode by default, provide --type to manually send rotation requests.")
c.cmd.Flag("interactive", "Enable interactive mode").BoolVar(&c.interactiveMode)
c.cmd.Flag("manual", "Activate manual rotation, set rotation phases manually").BoolVar(&c.manualMode)
c.cmd.Flag("type", fmt.Sprintf("Certificate authority to rotate, one of: %s", strings.Join(getCertAuthTypes(), ", "))).EnumVar(&c.caType, getCertAuthTypes()...)
c.cmd.Flag("type", "Certificate authority to rotate.").EnumVar(&c.caType, getCertAuthTypes()...)
c.cmd.Flag("phase", fmt.Sprintf("Target rotation phase to set, used in manual rotation, one of: %v", strings.Join(types.RotatePhases, ", "))).StringVar(&c.targetPhase)
c.cmd.Flag("grace-period", "Grace period keeps previous certificate authorities signatures valid, if set to 0 will force users to re-login and nodes to re-register.").
Default(fmt.Sprintf("%v", defaults.RotationGracePeriod)).
tool/tctl/common/bots_command.go
+3 -3
View File
@@ -117,7 +117,7 @@ type BotsCommand struct {
// `bot instances add`
func (c *BotsCommand) initSharedBotTokenFlags(cmd *kingpin.CmdClause) {
cmd.Flag("token", "The token to use, if any. If unset, a new single-use token will be created.").StringVar(&c.tokenID)
cmd.Flag("format", "Output format, one of: text, json").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
cmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
// TODO(timothyb89): Remove in v20 (optional)
cmd.Flag("legacy", "If set, generate a legacy joining token instead of a bound keypair token. No effect if --token is set.").BoolVar(&c.legacy)
@@ -157,7 +157,7 @@ func (c *BotsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF
bots := app.Command("bots", "Manage Machine & Workload Identity bots on the cluster.").Alias("bot")
c.botsList = bots.Command("ls", "List all certificate renewal bots registered with the cluster.")
c.botsList.Flag("format", "Output format, 'text' or 'json'").Hidden().Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
c.botsList.Flag("format", "Output format.").Hidden().Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
c.botsAdd = bots.Command("add", "Add a new bot to the cluster.")
c.botsAdd.Arg("name", "A name to uniquely identify this bot in the cluster.").Required().StringVar(&c.botName)
@@ -190,7 +190,7 @@ func (c *BotsCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCLIF
c.botsInstancesList = c.botsInstances.Command("list", "List bot instances.").Alias("ls")
c.botsInstancesList.Arg("name", "The name of the bot from which to list instances. If unset, lists instances from all bots.").StringVar(&c.botName)
c.botsInstancesList.Flag("format", "Output format, 'text' or 'json'").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
c.botsInstancesList.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.format, teleport.Text, teleport.JSON)
c.botsInstancesList.Flag("search", "Fuzzy search query used to filter bot instances").StringVar(&c.search)
c.botsInstancesList.Flag("query", "An expression in the Teleport predicate language used to filter bot instances").StringVar(&c.query)
c.botsInstancesList.Flag("sort-index", "Request sort index, 'bot_name', 'active_at_latest', 'version_latest' or 'host_name_latest'").Default("bot_name").StringVar(&c.sortIndex)
tool/tctl/common/devices.go
+2 -2
View File
@@ -94,10 +94,10 @@ func (c *DevicesCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalC
BoolVar(&c.add.enroll)
addCmd.Flag("enroll-ttl", "Time duration for the enrollment token").
DurationVar(&c.add.enrollTTL)
addCmd.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.add.format, formats...)
addCmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.add.format, formats...)
lsCmd := devicesCmd.Command("ls", "Lists managed devices.")
lsCmd.Flag("format", "Output format, 'text', 'json', or 'yaml'").Default(teleport.Text).EnumVar(&c.ls.format, formats...)
lsCmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.ls.format, formats...)
rmCmd := devicesCmd.Command("rm", "Removes a managed device.")
rmCmd.Flag("device-id", "Device identifier").StringVar(&c.rm.deviceID)
tool/tctl/common/notification_command.go
+1 -1
View File
@@ -88,7 +88,7 @@ func (n *NotificationCommand) Initialize(app *kingpin.Application, _ *tctlcfg.Gl
n.ls = notif.Command("ls", "List notifications which were manually created using `tctl notifications create`. By default, this will list notifications capable of targeting multiple users, such as role-based ones. To list notifications directed only at a specific user, use the --user flag. To include notifications generated by Teleport, use --all.")
n.ls.Flag("user", "Set which user to list user-specific notifications for, or leave empty to list your own.").StringVar(&n.user)
n.ls.Flag("format", "Output format, 'yaml', 'json', or 'text'").Default(teleport.Text).EnumVar(&n.format, teleport.YAML, teleport.JSON, teleport.Text)
n.ls.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&n.format, teleport.YAML, teleport.JSON, teleport.Text)
n.ls.Flag("all", "Set whether all notifications should be included, including those generated by Teleport, as opposed to solely those created using `tctl notifications create`.").BoolVar(&n.allNotifications)
n.ls.Flag("labels", labelHelp).StringVar(&n.labels)
tool/tctl/common/stableunixusers/command.go
+1 -1
View File
@@ -43,7 +43,7 @@ type Command struct {
func (c *Command) Initialize(app *kingpin.Application, _ *config.GlobalCLIFlags, _ *servicecfg.Config) {
rootCmd := app.Command("stable-unix-users", "Manage the database of stable UNIX users.")
c.lsCmd = rootCmd.Command("ls", "List the stable UNIX users currently persisted in the cluster.")
c.lsCmd.Flag("format", "Output format, 'text', or 'json'").Default(teleport.Text).EnumVar(&c.lsFormat, teleport.Text, teleport.JSON, teleport.YAML)
c.lsCmd.Flag("format", "Output format.").Default(teleport.Text).EnumVar(&c.lsFormat, teleport.Text, teleport.JSON, teleport.YAML)
}
// TryRun implements [tool/tctl/common.CLICommand].
tool/tctl/common/tctl.go
+1 -1
View File
@@ -166,7 +166,7 @@ func TryRun(ctx context.Context, commands []CLICommand, args []string) error {
app.Flag("insecure", "When specifying a proxy address in --auth-server, do not verify its TLS certificate. Danger: any data you send can be intercepted or modified by an attacker.").
BoolVar(&ccf.Insecure)
modes := []string{mfa.MFAModeAuto, mfa.MFAModeCrossPlatform, mfa.MFAModePlatform, mfa.MFAModeSSO, mfa.MFAModeBrowser}
app.Flag("mfa-mode", fmt.Sprintf("Preferred mode for MFA assertions (%v).", strings.Join(modes, ", "))).
app.Flag("mfa-mode", "Preferred mode for MFA assertions.").
Default(mfa.MFAModeAuto).
Envar(mfaModeEnvVar).
EnumVar(&ccf.MFAMode, modes...)
tool/tctl/common/token_command.go
+2 -2
View File
@@ -170,7 +170,7 @@ func (c *TokensCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCL
c.tokenAdd.Flag("db-name", "Name of the database to add").StringVar(&c.dbName)
c.tokenAdd.Flag("db-protocol", fmt.Sprintf("Database protocol to use. Supported are: %v", defaults.DatabaseProtocols)).StringVar(&c.dbProtocol)
c.tokenAdd.Flag("db-uri", "Address the database is reachable at").StringVar(&c.dbURI)
c.tokenAdd.Flag("format", "Output format, 'text', 'json', or 'yaml'").EnumVar(&c.format, formats...)
c.tokenAdd.Flag("format", "Output format.").EnumVar(&c.format, formats...)
// "tctl tokens rm ..."
c.tokenDel = tokens.Command("rm", "Delete/revoke an invitation token.").Alias("del")
@@ -178,7 +178,7 @@ func (c *TokensCommand) Initialize(app *kingpin.Application, _ *tctlcfg.GlobalCL
// "tctl tokens ls"
c.tokenList = tokens.Command("ls", "List node and user invitation tokens.")
c.tokenList.Flag("format", "Output format, 'text', 'json' or 'yaml'").EnumVar(&c.format, formats...)
c.tokenList.Flag("format", "Output format.").EnumVar(&c.format, formats...)
c.tokenList.Flag("with-secrets", "Do not redact join tokens").BoolVar(&c.withSecrets)
c.tokenList.Flag("labels", labelHelp).StringVar(&c.labels)
tool/tctl/sso/configure/oidc.go
+1 -1
View File
@@ -150,7 +150,7 @@ func addOIDCCommand(cmd *SSOConfigureCommand) *AuthKindCommand {
sub := cmd.ConfigureCmd.Command("oidc", fmt.Sprintf("Configure OIDC auth connector, optionally using a preset. Available presets: %v.", oidcPresets.getNames()))
// commonly used flags
sub.Flag("preset", fmt.Sprintf("Preset. One of: %v", oidcPresets.getNames())).Short('p').EnumVar(&extra.chosenPreset, oidcPresets.getNames()...)
sub.Flag("preset", "Preset.").Short('p').EnumVar(&extra.chosenPreset, oidcPresets.getNames()...)
sub.Flag("name", "Connector name. Required, unless implied from preset.").Short('n').StringVar(&extra.connectorName)
sub.Flag("claims-to-roles", "Sets claim-to-roles mapping using format 'claim_name,claim_value,role1,role2,...'. Repeatable.").Short('r').Required().PlaceHolder("name,value,role1,role2,...").SetValue(flags.NewClaimsToRolesParser(&spec.ClaimsToRoles))
sub.Flag("display", "Sets the connector display name.").StringVar(&spec.Display)
tool/tctl/sso/configure/saml.go
+1 -1
View File
@@ -96,7 +96,7 @@ func addSAMLCommand(cmd *SSOConfigureCommand) *AuthKindCommand {
saml := &samlExtraFlags{}
// commonly used flags
sub.Flag("preset", fmt.Sprintf("Preset. One of: %v", samlPresets.getNames())).Short('p').EnumVar(&saml.chosenPreset, samlPresets.getNames()...)
sub.Flag("preset", "Preset.").Short('p').EnumVar(&saml.chosenPreset, samlPresets.getNames()...)
sub.Flag("name", "Connector name. Required, unless implied from preset.").Short('n').StringVar(&saml.connectorName)
sub.Flag("entity-descriptor", "Set the Entity Descriptor. Valid values: file, URL, XML content. Supplies configuration parameters as single XML instead of individual elements.").Short('e').StringVar(&saml.entityDescriptorFlag)
sub.Flag("attributes-to-roles", "Sets attribute-to-role mapping using format 'attr_name,attr_value,role1,role2,...'. Repeatable.").Short('r').Required().SetValue(flags.NewAttributesToRolesParser(&spec.AttributesToRoles))
tool/teleport/common/teleport.go
+10 -6
View File
@@ -158,8 +158,11 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
start.Flag("config",
fmt.Sprintf("Path to a configuration file [%v]", defaults.ConfigFilePath)).
Short('c').ExistingFileVar(&ccf.ConfigFile)
applyOnStartupSupportedKinds := slices.Collect(maps.Keys(auth.ResourceApplyPriority))
slices.Sort(applyOnStartupSupportedKinds)
start.Flag("apply-on-startup",
fmt.Sprintf("Path to a non-empty YAML file containing resources to apply on startup. Works on initialized clusters, unlike --bootstrap. Only supports the following kinds: %s.", slices.Collect(maps.Keys(auth.ResourceApplyPriority)))).
fmt.Sprintf("Path to a non-empty YAML file containing resources to apply on startup. Works on initialized clusters, unlike --bootstrap. Only supports the following kinds: %s.", strings.Join(applyOnStartupSupportedKinds, ","))).
ExistingFileVar(&ccf.ApplyOnStartupFile)
start.Flag("bootstrap",
"Path to a non-empty YAML file containing bootstrap resources (ignored if already initialized)").ExistingFileVar(&ccf.BootstrapFile)
@@ -273,7 +276,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
for _, endpointType := range gcp.AlloyDBEndpointTypes {
alloyDBEndpointTypes = append(alloyDBEndpointTypes, string(endpointType))
}
dbStartCmd.Flag("gcp-alloydb-endpoint-type", fmt.Sprintf("(Only for AlloyDB) Endpoint type. One of: %v", alloyDBEndpointTypes)).EnumVar(&ccf.DatabaseGCPAlloyDBEndpointType, alloyDBEndpointTypes...)
dbStartCmd.Flag("gcp-alloydb-endpoint-type", "(Only for AlloyDB) Endpoint type.").EnumVar(&ccf.DatabaseGCPAlloyDBEndpointType, alloyDBEndpointTypes...)
dbStartCmd.Flag("ad-keytab-file", "(Only for SQL Server) Kerberos keytab file.").StringVar(&ccf.DatabaseADKeytabFile)
dbStartCmd.Flag("ad-krb5-file", "(Only for SQL Server) Kerberos krb5.conf file.").Default(defaults.Krb5FilePath).StringVar(&ccf.DatabaseADKrb5File)
dbStartCmd.Flag("ad-domain", "(Only for SQL Server) Active Directory domain.").StringVar(&ccf.DatabaseADDomain)
@@ -445,7 +448,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
dump.Flag("key-file", "Path to a TLS key file for the proxy.").ExistingFileVar(&dumpFlags.KeyFile)
dump.Flag("data-dir", "Path to a directory where Teleport keep its data.").Default(defaults.DataDir).StringVar(&dumpFlags.DataDir)
dump.Flag("token", "Invitation token or path to file with token value to register with an auth server.").StringVar(&dumpFlags.AuthToken)
dump.Flag("join-method", fmt.Sprintf("Method to use to join the cluster (%s)", strings.Join(joinMethods, ", "))).Default("token").EnumVar(&dumpFlags.JoinMethod, joinMethods...)
dump.Flag("join-method", "Method to use to join the cluster.").Default("token").EnumVar(&dumpFlags.JoinMethod, joinMethods...)
dump.Flag("roles", "Comma-separated list of roles to create config with.").StringVar(&dumpFlags.Roles)
dump.Flag("auth-server", "Address of the auth server.").StringVar(&dumpFlags.AuthServer)
dump.Flag("proxy", "Address of the proxy.").StringVar(&dumpFlags.ProxyAddress)
@@ -472,7 +475,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
dumpNodeConfigure.Flag("proxy", "Address of the proxy server.").StringVar(&dumpFlags.ProxyAddress)
dumpNodeConfigure.Flag("labels", "Comma-separated list of labels to add to newly created nodes ex) env=staging,cloud=aws.").StringVar(&dumpFlags.NodeLabels)
dumpNodeConfigure.Flag("ca-pin", "Comma-separated list of SKPI hashes for the CA used to verify the auth server.").StringVar(&dumpFlags.CAPin)
dumpNodeConfigure.Flag("join-method", fmt.Sprintf("Method to use to join the cluster (%s)", strings.Join(joinMethods, ", "))).Default("token").EnumVar(&dumpFlags.JoinMethod, joinMethods...)
dumpNodeConfigure.Flag("join-method", "Method to use to join the cluster.").Default("token").EnumVar(&dumpFlags.JoinMethod, joinMethods...)
dumpNodeConfigure.Flag("node-name", "Name for the Teleport node.").StringVar(&dumpFlags.NodeName)
dumpNodeConfigure.Flag("silent", "Suppress user hint message.").BoolVar(&dumpFlags.Silent)
dumpNodeConfigure.Flag("azure-client-id", "Sets the client ID of the managed identity to join with. Only applies to the 'azure' join method.").StringVar(&dumpFlags.AzureClientID)
@@ -491,7 +494,7 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
// teleport join --proxy-server=proxy.example.com --token=aws-join-token [--openssh-config=/path/to/sshd.conf] [--restart-sshd=true]
joinOpenSSH.Flag("proxy-server", "Address of the proxy server.").StringVar(&ccf.ProxyServer)
joinOpenSSH.Flag("token", "Invitation token or path to file with token value to register with an auth server.").StringVar(&ccf.AuthToken)
joinOpenSSH.Flag("join-method", "Method to use to join the cluster (token, iam, ec2).").EnumVar(&ccf.JoinMethod, "token", "iam", "ec2")
joinOpenSSH.Flag("join-method", "Method to use to join the cluster.").EnumVar(&ccf.JoinMethod, "token", "iam", "ec2")
joinOpenSSH.Flag("openssh-config", fmt.Sprintf("Path to the OpenSSH config file [%v].", "/etc/ssh/sshd_config")).Default("/etc/ssh/sshd_config").StringVar(&ccf.OpenSSHConfigPath)
joinOpenSSH.Flag("data-dir", fmt.Sprintf("Path to directory to store teleport data [%v].", defaults.DataDir)).Default(defaults.DataDir).StringVar(&ccf.DataDir)
joinOpenSSH.Flag("restart-sshd", "Restart OpenSSH.").Default("true").BoolVar(&ccf.RestartOpenSSH)
@@ -631,7 +634,8 @@ func Run(options Options) (app *kingpin.Application, executedCommand string, con
getLogLevelCmd := debugCmd.Command("get-log-level", "Fetches current log level.")
collectProfilesCmd := debugCmd.Command("profile", "Export the application profiles (pprof format). Outputs to stdout .tar.gz file contents.")
collectProfilesCmd.Alias(collectProfileUsageExamples) // We're using "alias" section to display usage examples.
collectProfilesCmd.Arg("PROFILES", fmt.Sprintf("Comma-separated profile names to be exported. Supported profiles: %s. Default: %s", strings.Join(slices.Collect(maps.Keys(debugclient.SupportedProfiles)), ","), strings.Join(defaultCollectProfiles, ","))).StringVar(&ccf.Profiles)
supportedProfiles := slices.Sorted(maps.Keys(debugclient.SupportedProfiles))
collectProfilesCmd.Arg("PROFILES", fmt.Sprintf("Comma-separated profile names to be exported. Supported profiles: %s. Default: %s", strings.Join(supportedProfiles, ","), strings.Join(defaultCollectProfiles, ","))).StringVar(&ccf.Profiles)
collectProfilesCmd.Flag("seconds", "For CPU and trace profiles, profile for the given duration (if set to 0, it returns a profile snapshot). For other profiles, return a delta profile. Default: 0").Short('s').Default("0").IntVar(&ccf.ProfileSeconds)
readyzCmd := debugCmd.Command("readyz", "Checks if the instance is ready to serve requests.")
metricsCmd := debugCmd.Command("metrics", "Fetches the cluster's Prometheus metrics.")
tool/tsh/common/kube.go
+1 -1
View File
@@ -110,7 +110,7 @@ func newKubeJoinCommand(parent *kingpin.CmdClause) *kubeJoinCommand {
CmdClause: parent.Command("join", "Join an active Kubernetes session."),
}
c.Flag("mode", "Mode of joining the session, valid modes are observer, moderator and peer.").Short('m').Default("observer").EnumVar(&c.mode, "observer", "moderator", "peer")
c.Flag("mode", "Mode of joining the session.").Short('m').Default("observer").EnumVar(&c.mode, "observer", "moderator", "peer")
c.Flag("cluster", clusterHelp).Short('c').StringVar(&c.siteName)
c.Arg("session", "The ID of the target session.").Required().StringVar(&c.session)
return c
tool/tsh/common/scan.go
+6 -2
View File
@@ -57,7 +57,11 @@ type scanKeysCommand struct {
func newScanKeysCommand(parent *kingpin.CmdClause) *scanKeysCommand {
c := &scanKeysCommand{CmdClause: parent.Command("keys", "Scan the local machine for SSH private keys and report findings to Teleport.")}
c.Flag("dirs", "Directories to scan.").Default(defaultDirValues()).StringsVar(&c.dirs)
c.Flag("dirs", fmt.Sprintf("Directories to scan. Defaults to %s on %s, %s on %s, and %s on %s.",
"/home/", "Linux",
"/Users/", "macOS",
`C:\Users\`, "Windows",
)).StringsVar(&c.dirs)
c.Flag("skip-paths", "Paths to directories or files to skip. Supports for matching patterns.").StringsVar(&c.skipPaths)
return c
}
@@ -77,7 +81,7 @@ func defaultDirValues() string {
func (c *scanKeysCommand) run(cf *CLIConf) error {
if len(c.dirs) == 0 {
return trace.BadParameter("no directories to scan")
c.dirs = []string{defaultDirValues()}
}
if cf.Proxy == "" {
tool/tsh/common/tsh.go
+5 -6
View File
@@ -957,7 +957,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
fmt.Sprintf("Verbose logging to the unified logging system. This flag implies --debug. Also available through the %s env var. More details see https://goteleport.com/docs/connect-your-client/tsh/#debug-logs.",
osLogEnvVar)).
IsSetByUser(&cf.OSLogSetByUser)
if runtime.GOOS != constants.DarwinOS {
if runtime.GOOS != constants.DarwinOS && !utils.DocsMode {
osLogFlag.Hidden()
}
osLogFlag.BoolVar(&cf.OSLog)
@@ -974,7 +974,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
app.Flag("callback", "Override the base URL (host:port) of the link shown when opening a browser for cluster logins. Must be used with --bind-addr.").StringVar(&cf.CallbackAddr)
app.Flag("browser-login", browserHelp).Hidden().Envar(browserEnvVar).StringVar(&cf.Browser)
modes := []string{mfaModeAuto, mfaModeCrossPlatform, mfaModePlatform, mfaModeOTP, mfaModeSSO, mfaModeBrowser}
app.Flag("mfa-mode", fmt.Sprintf("Preferred mode for MFA and Passwordless assertions (%v).", strings.Join(modes, ", "))).
app.Flag("mfa-mode", "Preferred mode for MFA and Passwordless assertions.").
Default(mfaModeAuto).
Envar(mfaModeEnvVar).
EnumVar(&cf.MFAMode, modes...)
@@ -1014,7 +1014,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
ssh.Flag("reason", "The purpose of the session.").StringVar(&cf.Reason)
ssh.Flag("participant-req", "Displays a verbose list of required participants in a moderated session.").BoolVar(&cf.displayParticipantRequirements)
ssh.Flag("request-reason", "Reason for requesting access.").StringVar(&cf.RequestReason)
ssh.Flag("request-mode", fmt.Sprintf("Type of automatic Access Request to make (%s).", strings.Join(accessRequestModes, ", "))).Envar(requestModeEnvVar).Default(accessRequestModeResource).EnumVar(&cf.RequestMode, accessRequestModes...)
ssh.Flag("request-mode", "Type of automatic Access Request to make.").Envar(requestModeEnvVar).Default(accessRequestModeResource).EnumVar(&cf.RequestMode, accessRequestModes...)
ssh.Flag("disable-access-request", "Disable automatic resource Access Requests (DEPRECATED: use --request-mode=off).").BoolVar(&cf.disableAccessRequest)
ssh.Flag("log-dir", "Directory to log separated command output, when executing on multiple nodes. If set, output from each node will also be labeled in the terminal.").StringVar(&cf.SSHLogDir)
ssh.Flag("no-resume", "Disable SSH connection resumption.").Envar(noResumeEnvVar).BoolVar(&cf.DisableSSHResumption)
@@ -1208,8 +1208,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
dbConfig.Flag("query", queryHelp).StringVar(&cf.PredicateExpression)
// --db flag is deprecated in favor of positional argument for consistency with other commands.
dbConfig.Flag("db", "Print information for the specified database.").Hidden().StringVar(&cf.DatabaseService)
dbConfig.Flag("format", fmt.Sprintf("Print format: %q to print in table format (default), %q to print connect command, %q or %q to print in JSON or YAML.",
dbFormatText, dbFormatCommand, dbFormatJSON, dbFormatYAML)).Short('f').EnumVar(&cf.Format, dbFormatText, dbFormatCommand, dbFormatJSON, dbFormatYAML)
dbConfig.Flag("format", "Print format: \"text\" to print in table format (default), \"cmd\" to print connect command, \"json\" or \"yaml\" to print in JSON or YAML.").Short('f').EnumVar(&cf.Format, dbFormatText, dbFormatCommand, dbFormatJSON, dbFormatYAML)
dbConnect := db.Command("connect", "Connect to a database.")
dbConnect.Arg("db", "Database service name to connect to.").StringVar(&cf.DatabaseService)
dbConnect.Flag("db-user", "Database user to log in as.").Short('u').StringVar(&cf.DatabaseUser)
@@ -1236,7 +1235,7 @@ func Run(ctx context.Context, args []string, opts ...CliOption) error {
// join
join := app.Command("join", "Join the active SSH or Kubernetes session.")
join.Flag("cluster", clusterHelp).Short('c').StringVar(&cf.SiteName)
join.Flag("mode", "Mode of joining the session, valid modes are observer, moderator and peer.").Short('m').Default("observer").EnumVar(&cf.JoinMode, "observer", "moderator", "peer")
join.Flag("mode", "Mode of joining the session.").Short('m').Default("observer").EnumVar(&cf.JoinMode, "observer", "moderator", "peer")
join.Arg("session-id", "ID of the session to join.").Required().StringVar(&cf.SessionID)
// play
play := app.Command("play", "Replay the recorded session (SSH, Kubernetes, App, DB).")