mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-11 22:49:54 +00:00
Paul Gottschling
b19268b07b
* Add a Configuring Teleport docs section Make the how-to guides for managing Teleport resources with Infrastructure as Code tools more prominent by placing them in a Configuring Teleport section next to other foundational docs sections, e.g., Installation and Upgrading. Frame the task of managing Teleport with IaC as part of the broader task of configuring Teleport. To do so, move the introduction of the "Static and Dynamic Resources" page to a landing page for the new Configuration section. Move the remaining part of that page to the References section, since it's an advanced guide and more of a reference than a set of how-to instructions. This change also structures the Infrastructure as Code landing page into a Configure Teleport landing page by including links to guides for static as well as dynamic configuration. This adds clarity to the docs since users won't immediately know that Teleport exposes these two configuration variants. * Update internal links * Fix issues with the Configuring Teleport section - Update the static/dynamic field table to use the correct field name, `spec.mode`. - Change "Managing Resources" to "Resource Guides" for clarity, since all sections in Configuring Teleport would be about managing resources. - Reorder Configuration sidebar sections to move Resource Guides last and tctl before Terraform and Kubernetes.
143 lines
3.6 KiB
Plaintext
143 lines
3.6 KiB
Plaintext
---
|
|
title: Dynamic Database Registration
|
|
sidebar_label: Dynamic Registration
|
|
description: Register/unregister databases without restarting Teleport.
|
|
tags:
|
|
- conceptual
|
|
- zero-trust
|
|
- infrastructure-identity
|
|
---
|
|
|
|
Dynamic database registration allows Teleport administrators to register new
|
|
databases (or update/unregister existing ones) without having to update the
|
|
static configuration and restart Teleport Database Service instances.
|
|
|
|
Dynamic registration also enables administrators to deploy multiple Database
|
|
Service instances for [high availability](../../../installation/agents/high-availability.mdx) by
|
|
configuring Database Service replicas to watch for the same database resources.
|
|
|
|
To enable dynamic registration, include a `resources` section in your Teleport
|
|
Database Service configuration with a list of resource label selectors you'd like this
|
|
service to monitor for registering:
|
|
|
|
```yaml
|
|
db_service:
|
|
enabled: true
|
|
resources:
|
|
- labels:
|
|
"*": "*"
|
|
```
|
|
|
|
You can use a wildcard selector to register all dynamic database resources in the cluster
|
|
on the Database Service or provide a specific set of labels for a subset:
|
|
|
|
```yaml
|
|
resources:
|
|
- labels:
|
|
"env": "prod"
|
|
"engine": "postgres"
|
|
- labels:
|
|
"env": "test"
|
|
"engine": "mysql"
|
|
```
|
|
|
|
To see the currently running Database Services, run `tctl get db_services`:
|
|
|
|
```yaml
|
|
kind: db_service
|
|
metadata:
|
|
expires: "2024-08-27T11:38:10.207175Z"
|
|
name: 2b5207e3-a258-423e-a41d-e50ea2f0dfdc
|
|
spec:
|
|
hostname: my-host
|
|
resources:
|
|
- labels:
|
|
env: prod
|
|
engine: postgres
|
|
- labels:
|
|
env: test
|
|
engine: mysql
|
|
version: v1
|
|
```
|
|
|
|
The `name` within a `db_service` matches to the host ID of the agent running the Teleport Database Service.
|
|
|
|
Next define a database resource:
|
|
|
|
```yaml
|
|
kind: db
|
|
version: v3
|
|
metadata:
|
|
name: example
|
|
description: "Example database"
|
|
labels:
|
|
env: prod
|
|
engine: postgres
|
|
spec:
|
|
protocol: "postgres"
|
|
uri: "localhost:5432"
|
|
```
|
|
|
|
The user creating the dynamic registration needs to have a role with access to the
|
|
database labels and the `db` resource. In this example role the user can only
|
|
create and maintain databases labeled `env: prod` and `engine: postgres`.
|
|
```yaml
|
|
kind: role
|
|
metadata:
|
|
name: dynamicregexample
|
|
spec:
|
|
allow:
|
|
db_labels:
|
|
engine: postgres
|
|
env: prod
|
|
rules:
|
|
- resources:
|
|
- db
|
|
verbs:
|
|
- list
|
|
- create
|
|
- read
|
|
- update
|
|
- delete
|
|
version: v5
|
|
```
|
|
|
|
See the full database resource [reference](../../../reference/infrastructure-as-code/teleport-resources/database-v3.mdx).
|
|
|
|
To create a database resource, run:
|
|
|
|
```code
|
|
$ tctl create database.yaml
|
|
```
|
|
|
|
- (!docs/pages/includes/tctl.mdx!)
|
|
|
|
After the resource has been created, it will appear among the list of available
|
|
databases (in `tsh db ls` or UI) as long as at least one Database Service
|
|
instance picks it up according to its label selectors.
|
|
|
|
To update an existing database resource, run:
|
|
|
|
```code
|
|
$ tctl create -f database.yaml
|
|
```
|
|
|
|
If the updated resource's labels no longer match a particular database, it
|
|
will unregister and stop proxying it.
|
|
|
|
To delete a database resource, run:
|
|
|
|
```code
|
|
$ tctl rm db/example
|
|
```
|
|
|
|
Aside from `tctl`, dynamic resources can also be added by:
|
|
- [Auto-Discovery](../../auto-discovery/databases/databases.mdx)
|
|
- [Terraform Provider](../../../configuration/terraform-provider/terraform-provider.mdx)
|
|
- [Kubernetes Operator](../../../configuration/teleport-operator/teleport-operator.mdx)
|
|
- [Teleport API](../../../zero-trust-access/api/api.mdx)
|
|
|
|
See [Using Dynamic Resources](../../../configuration/configuration.mdx) to learn
|
|
more about managing Teleport's dynamic resources in general.
|
|
|