Merge branch 'master' into bernard/tctl-alert-ttl

gravitational · Jun 24, 2024 · 06c163b · 06c163b
2 parents 1d4a208 + b40c3d4
commit 06c163b
Show file tree

Hide file tree

Showing 66 changed files with 3,328 additions and 3,027 deletions.
diff --git a/api/proto/teleport/legacy/types/types.proto b/api/proto/teleport/legacy/types/types.proto
@@ -619,6 +619,13 @@ message DatabaseTLS {
   // ServerName allows to provide custom hostname. This value will override the
   // servername/hostname on a certificate during validation.
   string ServerName = 3 [(gogoproto.jsontag) = "server_name,omitempty"];
+  // TrustSystemCertPool allows Teleport to trust certificate authorities
+  // available on the host system. If not set (by default), Teleport only
+  // trusts self-signed databases with TLS certificates signed by Teleport's
+  // Database Server CA or the ca_cert specified in this TLS setting. For
+  // cloud-hosted databases, Teleport downloads the corresponding required CAs
+  // for validation.
+  bool TrustSystemCertPool = 4 [(gogoproto.jsontag) = "trust_system_cert_pool,omitempty"];
 }
 
 // MySQLOptions are additional MySQL database options.

diff --git a/api/types/derived.gen.go b/api/types/derived.gen.go
diff --git a/api/types/types.pb.go b/api/types/types.pb.go
diff --git a/docs/config.json b/docs/config.json
@@ -29,29 +29,12 @@
               "slug": "/upgrading/overview/"
             },
             {
-              "title": "Teleport Cloud Agents (Linux)",
-              "slug": "/upgrading/cloud-linux/",
-              "forScopes": ["cloud"]
-            },
-            {
-              "title": "Teleport Cloud Agents (Kubernetes)",
-              "slug": "/upgrading/cloud-kubernetes/",
-              "forScopes": ["cloud"]
-            },
-            {
-              "title": "Self-Hosted Linux",
-              "slug": "/upgrading/self-hosted-linux/",
-              "forScopes": ["enterprise", "oss"]
-            },
-            {
-              "title": "Self-Hosted Kubernetes",
-              "slug": "/upgrading/self-hosted-kubernetes/",
-              "forScopes": ["enterprise", "oss"]
+                "title": "Set up Automatic Agent Updates",
+                "slug": "/upgrading/automatic-agent-updates/"
             },
             {
-              "title": "Self-Hosted Automatic Upgrades",
-              "slug": "/upgrading/self-hosted-automatic-agent-updates/",
-              "forScopes": ["enterprise"]
+                "title": "Updating Reference",
+                "slug": "/upgrading/reference/"
             }
           ]
         },
@@ -493,11 +476,24 @@
         },
         {
           "title": "Teleport Policy",
-          "slug": "/access-controls/access-graph/",
-          "forScopes": [
-            "enterprise"
-          ],
+          "slug": "/access-controls/teleport-policy/getting-started-policy/",
+          "forScopes": ["enterprise", "cloud"],
           "entries": [
+            {
+              "title": "Teleport Policy Integrations",
+              "slug": "/access-controls/teleport-policy/policy-integrations/",
+              "forScopes": ["enterprise", "cloud"]
+            },
+            {
+              "title": "Teleport Policy Connections",
+              "slug": "/access-controls/teleport-policy/policy-connections/",
+              "forScopes": ["enterprise", "cloud"]
+            },
+            {
+              "title": "Teleport Policy Usage",
+              "slug" : "/access-controls/teleport-policy/policy-how-to-use/",
+              "forScopes":["enterprise","cloud"]
+            },
             {
               "title": "Teleport Policy for Self-Hosted Clusters",
               "slug": "/access-controls/access-graph/self-hosted/",
@@ -2420,6 +2416,11 @@
       "destination": "/access-controls/introduction/",
       "permanent": true
     },
+    {
+      "source": "/access-controls/teleport-policy/",
+      "destination": "/access-controls/teleport-policy/getting-started-policy/",
+      "permanent": true
+    },
     {
       "source": "/try-out-teleport/",
       "destination": "/",
@@ -2697,7 +2698,7 @@
     },
     {
       "source": "/management/operations/self-hosted-automatic-agent-updates/",
-      "destination": "/upgrading/self-hosted-automatic-agent-updates/",
+      "destination": "/upgrading/",
       "permanent": true
     },
     {
@@ -2715,11 +2716,6 @@
       "destination": "/server-access/guides/",
       "permanent": true
     },
-    {
-      "source": "/access-graph/",
-      "destination": "/access-controls/access-graph/",
-      "permanent": true
-    },
     {
       "source": "/database-access/guides/aws-discovery/",
       "destination": "/auto-discovery/databases/",

diff --git a/docs/img/access-graph/aws_access_graph_policy_step1.png b/docs/img/access-graph/aws_access_graph_policy_step1.png
diff --git a/docs/img/access-graph/aws_access_graph_regions_step3.png b/docs/img/access-graph/aws_access_graph_regions_step3.png
diff --git a/docs/img/access-graph/aws_enable_sync_access_graph_step2.png b/docs/img/access-graph/aws_enable_sync_access_graph_step2.png
diff --git a/docs/img/access-graph/connection_view.png b/docs/img/access-graph/connection_view.png
diff --git a/docs/img/access-graph/graph_view.png b/docs/img/access-graph/graph_view.png
diff --git a/docs/img/access-graph/query_view.png b/docs/img/access-graph/query_view.png
diff --git a/docs/img/access-graph/search_view.png b/docs/img/access-graph/search_view.png
diff --git a/docs/pages/access-controls/access-graph.mdx b/docs/pages/access-controls/access-graph.mdx
diff --git a/docs/pages/access-controls/access-graph/aws-sync.mdx b/docs/pages/access-controls/access-graph/aws-sync.mdx
@@ -30,7 +30,7 @@ Access Graph options can be found under the Permission Management section.
 Teleport Access Graph discovers AWS access patterns, synchronizes various AWS resources,
 including IAM Policies, Groups, Users, User Groups, EC2 instances, EKS clusters, and RDS databases. 
 These resources are then visualized using the graph representation detailed in the
-[Access Graph page](../access-graph.mdx).
+[Access Graph page](../teleport-policy/getting-started-policy.mdx).
 
 The importing process involves two primary steps:
 
@@ -66,7 +66,7 @@ graphical representation thereof.
 - A running Teleport Enterprise cluster v14.3.9/v15.2.0 or later.
 - For self-hosted clusters, an updated `license.pem` with Teleport Policy enabled.
 - For self-hosted clusters, a running Teleport Access Graph node v1.17.0 or later. 
-Check [Access Graph page](../access-graph.mdx) for details on
+Check [Access Graph page](../teleport-policy/getting-started-policy.mdx) for details on
 how to setup Teleport Access Graph.
 - The node running the Access Graph service must be reachable
 from Teleport Auth Service and Discovery Service. 

diff --git a/docs/pages/access-controls/teleport-policy/getting-started-policy.mdx b/docs/pages/access-controls/teleport-policy/getting-started-policy.mdx
@@ -0,0 +1,29 @@
+---
+title: Teleport Policy
+description: A reference for Access Graph with Teleport Policy.
+---
+
+Teleport Policy streamlines and centralizes access management across your entire infrastructure. Access Graph provides a 
+visual representation of the relationships between users, roles, and resources in your organization. 
+It can help you answer questions like:
+
+- What resources can a specific user access?
+- What users can access a specific resource?
+- What are the relationships between users, roles, and resources?
+
+## Getting started with Teleport Policy
+
+Access Graph is a feature of the Teleport Policy product that is only 
+available to Teleport Enterprise customers.
+
+After logging into the Teleport UI, go to the Management tab. If enabled, Access Graph options can be found
+under the Permission Management section.
+
+<Admonition type="note">
+Note: For managed Teleport Enterprise customers, Access Graph is enabled by default.
+If you are a self-hosted Teleport customer, you will need to set up [Access Graph](../access-graph/self-hosted.mdx) and ensure you have an updated 
+`license.pem` with Teleport Policy enabled to use it.
+</Admonition>
+
+## Next steps
+- Set up [Policy integrations](./policy-integrations.mdx) for use with Access Graph.