mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-11 22:49:54 +00:00
mica
2f0c4b6b7a
* docs: critical and high sev agent blockers * Fix high-severity documentation issues found during audit: Rewrite awsoidc-integration.mdx verification section to show expected output and clarify that tctl get does not validate the AWS trust relationship. Correct EKS SSO claim to distinguish IAM role ARN from STS session ARN. Revert redis-create-users.mdx to original secure guidance (unsubstantiated claim, broken ACL). Add eice deprecation note to ec2-config.mdx. Fix numbered list in kubernetes-oidc-join-token.mdx. * Removed the false claim that TLS routing 'routes traffic locally without the reverse tunnel', removed the blanket 'replace port 443' instruction that would break tsh login, and replaced the misleading admonition that presented elastic as a working alias with a clear note that elasticsearch is the only valid value and the CLI doesn't validate input * Added the requirement for iam:GetRole when using SSO roles, with an explanation of what happens without it, and Split the CA trust instruction into self-hosted vs Cloud paths. * linter casing * linter casing * post-review feedback for ptgott - removed admonition tags, added tls info to prereq/rephrased for user or admin * post-feedback from zmb3: cut down tls routing info, clarify the labeling of the CA bundle * fold CA admonition into prose, clarify server.cas naming * feedback: db entries for single-node deployments and NAT hairpinning limitations * single note include addition for mysql and cockroach dbs * removing duplicate note for headless environments * feedback: Expanded tsh proxy db command with full working command, reduced admonition clutter, and in edition-prereqs I split the guidance into two bullets for tctl and tctl commands * Documents the correct critical endpoint and distinguishes it from optional metadata access in mysql-postgres-mariadb * corrected the China region hostname per verified Codex feedback * added identity.pem to connection string * update tbot instance re-creation tip * edit hostname to appease linter. users are already instructed to replace host with their own (line 15) so this is sufficent * edit hostname to appease linter. plain placeholder is clear enough * casing linter appeasement * moved mysql-postgres-mariadb admonition to troubleshooting, style changes
132 lines
4.0 KiB
Plaintext
132 lines
4.0 KiB
Plaintext
---
|
|
title: Database Access with Redis
|
|
sidebar_label: Redis
|
|
description: How to configure Teleport database access with Redis.
|
|
tags:
|
|
- how-to
|
|
- zero-trust
|
|
- infrastructure-identity
|
|
page_type: how-to
|
|
---
|
|
|
|
{/* vale messaging.protocol-products = NO */}
|
|
If you want to configure Redis Cluster, please read [Database Access with Redis Cluster](redis-cluster.mdx).
|
|
{/* vale messaging.protocol-products = YES */}
|
|
|
|
(!docs/pages/includes/database-access/self-hosted-introduction.mdx dbType="Redis"!)
|
|
|
|
## How it works
|
|
|
|
(!docs/pages/includes/database-access/how-it-works/mtls.mdx db="Redis"!)
|
|
|
|
<Tabs>
|
|
<TabItem scope={["oss", "enterprise"]} label="Self-Hosted">
|
|
|
|
</TabItem>
|
|
<TabItem scope={["cloud","team"]} label="Teleport Cloud">
|
|
|
|
</TabItem>
|
|
|
|
</Tabs>
|
|
|
|
## Prerequisites
|
|
|
|
(!docs/pages/includes/edition-prereqs-tabs.mdx!)
|
|
|
|
- Redis version `6.0` or newer.
|
|
|
|
<Admonition type="note" title="Note">
|
|
RESP3 (REdis Serialization Protocol) is currently not supported.
|
|
</Admonition>
|
|
|
|
- `redis-cli` version `6.2` or newer installed and added to your system's `PATH` environment variable.
|
|
|
|
- A host where you will run the Teleport Database Service.
|
|
|
|
See [Installation](../../../../installation/single-machine/single-machine.mdx) for details.
|
|
|
|
- Optional: a certificate authority that issues certificates for
|
|
your self-hosted database.
|
|
|
|
- (!docs/pages/includes/tctl.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/single-node-note.mdx!)
|
|
|
|
## Step 1/5. Set up the Teleport Database Service
|
|
|
|
(!docs/pages/includes/tctl-token.mdx serviceName="Database" tokenType="db" tokenFile="/tmp/token"!)
|
|
|
|
Install and configure Teleport where you will run the Teleport Database Service:
|
|
|
|
<Tabs>
|
|
<TabItem label="Linux Server">
|
|
|
|
(!docs/pages/includes/install-linux.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/self-hosted-config-start.mdx dbName="example-redis" dbProtocol="redis" databaseAddress="rediss://redis.example.com:6379" !)
|
|
|
|
</TabItem>
|
|
<TabItem label="Kubernetes Cluster">
|
|
Teleport provides Helm charts for installing the Teleport Database Service in Kubernetes Clusters.
|
|
|
|
(!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!)
|
|
|
|
(!docs/pages/includes/database-access/self-hosted-db-helm-install.mdx dbName="example-redis" dbProtocol="redis" databaseAddress="rediss://redis.example.com:6379" !)
|
|
</TabItem>
|
|
</Tabs>
|
|
|
|
(!docs/pages/includes/database-access/multiple-instances-tip.mdx !)
|
|
|
|
## Step 2/5. Create a Teleport user
|
|
|
|
(!docs/pages/includes/database-access/create-user.mdx!)
|
|
|
|
## Step 3/5. Create Redis users
|
|
|
|
(!docs/pages/includes/database-access/redis-create-users.mdx!)
|
|
|
|
## Step 4/5. Set up mutual TLS
|
|
|
|
(!docs/pages/includes/database-access/tctl-auth-sign-3-files.mdx format="redis" dbname="Redis" !)
|
|
|
|
You will need these files to enable mutual TLS on your Redis server.
|
|
|
|
Use the generated secrets to enable mutual TLS in your `redis.conf` configuration
|
|
file and restart the database:
|
|
|
|
```ini
|
|
tls-port 6379
|
|
port 0
|
|
aclfile /path/to/users.acl
|
|
tls-ca-cert-file /path/to/server.cas
|
|
tls-cert-file /path/to/server.crt
|
|
tls-key-file /path/to/server.key
|
|
tls-protocols "TLSv1.2 TLSv1.3"
|
|
```
|
|
|
|
Once mutual TLS has been enabled, you will no longer be able to connect to
|
|
the database without providing a valid client certificate. You can use the
|
|
`tls-auth-clients optional` setting to allow connections
|
|
from clients that do not present a certificate.
|
|
|
|
See [TLS Support](https://redis.io/docs/latest/operate/oss_and_stack/management/security/encryption/)
|
|
in the Redis documentation for more details.
|
|
|
|
## Step 5/5. Connect
|
|
|
|
(!docs/pages/includes/database-access/redis-connect.mdx!)
|
|
|
|
### Supported Redis commands
|
|
|
|
Redis in standalone mode doesn't support the commands below. If one of the listed commands is called Teleport
|
|
returns the <nobr>`ERR Teleport: not supported by Teleport`</nobr> error.
|
|
|
|
- `HELLO`
|
|
- `PUNSUBSCRIBE`
|
|
- `SSUBSCRIBE`
|
|
- `SUNSUBSCRIBE`
|
|
|
|
## Next steps
|
|
|
|
(!docs/pages/includes/database-access/guides-next-steps.mdx!)
|