Skip to content

Commit

Permalink
Getting started with Kubernetes (gravitational#5981)
Browse files Browse the repository at this point in the history
  • Loading branch information
benarent authored Mar 13, 2021
1 parent ebac3d8 commit a11ee59
Show file tree
Hide file tree
Showing 3 changed files with 20 additions and 22 deletions.
5 changes: 1 addition & 4 deletions docs/pages/kubernetes-access.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,4 @@ Your browser does not support the video tag.

## Getting Started

Configure Kubernets Access in a 10 minute [Getting Started](./kubernetes-access/getting-started.mdx) guide.



Configure Kubernetes Access in a 10 minute [Getting Started](./kubernetes-access/getting-started.mdx) guide.
28 changes: 14 additions & 14 deletions docs/pages/kubernetes-access/getting-started.mdx
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
title: Getting Started with Kubernetes Access
title: Getting Started with Kubernetes Access
description: Getting started with Teleport Kubernetes Access
---

Expand Down Expand Up @@ -37,9 +37,9 @@ Let's start with a single-pod Teleport using persistent volume as a backend.
$ helm repo add teleport https://charts.releases.teleport.dev

# Install a single node teleport cluster and provision a cert using ACME.
# Set clusterName to unique hostname, for example teleport.example.com
# Set clusterName to unique hostname, for example tele.example.com
# Set acmeEmail to receive correspondence from Letsencrypt certificate authority.
$ helm install teleport-cluster teleport-cluster --create-namespace --namespace=teleport-cluster \
$ helm install teleport-cluster teleport/teleport-cluster --create-namespace --namespace=teleport-cluster \
--set clusterName=${CLUSTER_NAME?} --set acme=true --set acmeEmail=${EMAIL?}
```
</TabItem>
Expand All @@ -57,7 +57,7 @@ $ kubectl config set-context --current --namespace=teleport-cluster-ent
$ kubectl -n teleport-cluster-ent create secret generic license --from-file=license-enterprise.pem

# Install Teleport
$ helm install teleport-cluster teleport-cluster --namespace=teleport-cluster-ent \
$ helm install teleport-cluster teleport/teleport-cluster --namespace=teleport-cluster-ent \
--set clusterName=${CLUSTER_NAME?} --set acme=true --set acmeEmail=${EMAIL?} --set enterprise=true
```
</TabItem>
Expand All @@ -77,7 +77,7 @@ $ kubectl get services
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
teleport-cluster LoadBalancer 10.4.4.73 104.199.126.88 443:31204/TCP,3026:32690/TCP 89s

# Save the pod IP. If the IP is not available, check the pod and load balancer status.
# Save the pod IP or Hostname. If the IP is not available, check the pod and load balancer status.
$ MYIP=$(kubectl get services teleport-cluster -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
$ echo $MYIP
192.168.2.1
Expand All @@ -93,7 +93,7 @@ $ kubectl get services
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
teleport-cluster-ent LoadBalancer 10.4.4.73 104.199.126.88 443:31204/TCP,3026:32690/TCP 89s

# Save the pod IP. If the IP is not available, check the pod and load balancer status.
# Save the pod IP or Hostname. If the IP is not available, check the pod and load balancer status.
$ MYIP=$(kubectl get services teleport-cluster-ent -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
$ echo $MYIP
192.168.2.1
Expand All @@ -106,7 +106,7 @@ Set up two `A` DNS records - `tele.example.com` for UI and `*.tele.example.com`
for web apps using [application access](../application-access.mdx).

<Tabs>
<TabItem label="Google DNS">
<TabItem label="GCP Cloud DNS">
```bash
$ MYZONE="myzone"
$ MYDNS="tele.example.com"
Expand Down Expand Up @@ -151,7 +151,7 @@ Teleport will respond back with a discovery info:
```bash
$ curl https://tele.example.com/webapi/ping

{"server_version":"5.0.0-dev","min_client_version":"3.0.0"}
{"auth":{"type":"local","second_factor":"otp"},"proxy":{"kube":{"enabled":true,"listen_addr":"0.0.0.0:3026"},"ssh":{"listen_addr":"[::]:3023","tunnel_listen_addr":"0.0.0.0:3024","public_addr":"tele.example.com:443"},"db":{}},"server_version":"6.0.1","min_client_version":"3.0.0"}
```

## Step 2/3 Create a local admin
Expand All @@ -178,13 +178,13 @@ Create the role and add a user:
```bash
# To create a local user, we are going to run Teleport's admin tool tctl from the pod.
$ POD=$(kubectl get po -l app=teleport-cluster -o jsonpath='{.items[0].metadata.name}')
$ POD=$(kubectl get pod -l app=teleport-cluster -o jsonpath='{.items[0].metadata.name}')

# Create a role
$ kubectl exec -i ${POD?} tctl -- create -f < member.yaml
$ kubectl exec -i ${POD?} -- tctl create -f < member.yaml

# Generate an invite link for the user.
$ kubectl exec -ti ${POD?} tctl -- users add alice --roles=member
$ kubectl exec -ti ${POD?} -- tctl users add alice --roles=member

User "alice" has been created but requires a password. Share this URL with the user to
complete user setup, link is valid for 1h:
Expand Down Expand Up @@ -240,15 +240,15 @@ teleport-cluster-6c9b88fd8f-glmhf 1/1 Running 0 127m

## Step 3/3 SSO for Kubernetes

We are going to setup Github connector for OSS and Okta for Enterpise version.
We are going to setup Github connector for OSS and Okta for Enterprise version.

<Tabs>
<TabItem label="Open Source">

Save the file below as `github.yaml` and update the fields. You will need to set up
[Github OAuth 2.0 Connector](https://developer.github.com/apps/building-oauth-apps/creating-an-oauth-app/) app.
Any member with the team `admin` in the organization `octocats` will be able to assume a builtin role `admin`.

```yaml
kind: github
version: v3
Expand Down Expand Up @@ -289,7 +289,7 @@ spec:
attributes_to_roles:
- {name: "groups", value: "okta-admin", roles: ["admin"]}
entity_descriptor: |
<?xml !!! Make sure to shift all lines in XML descriptor
<?xml !!! Make sure to shift all lines in XML descriptor
with 4 spaces, otherwise things will not work
```
</TabItem>
Expand Down
9 changes: 5 additions & 4 deletions examples/chart/teleport-cluster/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,12 @@ Great for getting started with Teleport.

## Getting Started

Install Teleport in a separate namespace and provision a web certificate using Letsencrypt:
Install Teleport in a separate namespace and provision a web certificate using
Let's Encrypt:

```bash
$ helm install teleport-cluster \
--set acmeEnabled=true \
$ helm install teleport/teleport-cluster \
--set acme=true \
--set [email protected] \
--set clusterName=teleport.example.com\
--create-namespace \
Expand All @@ -37,7 +38,7 @@ Check https://goteleport.com/teleport/docs for more details.
| `teleportVersionOverride` | Teleport version | Current stable version | no |
| `image` | OSS Docker image | `quay.io/gravitational/teleport` | no |
| `enterpriseImage` | Enterprise Docker image | `quay.io/gravitational/teleport-ent` | no |
| `acmeEnabled` | Enable ACME support in Teleport (Letsencrypt.org) | `false` | no |
| `acme` | Enable ACME support in Teleport (Letsencrypt.org) | `false` | no |
| `acmeEmail` | Email to use for ACME certificates | | no |
| `acmeURI` | ACME server to use for certificates | `https://acme-v02.api.letsencrypt.org/directory` | no |
| `labels.[name]` | Key-value pairs, for example `--labels.env=local --labels.region=us-west-1` | | no |
Expand Down

0 comments on commit a11ee59

Please sign in to comment.