Document that crdb can be used a a pg replacement for events (#44704)

* Document that crdb can be used a a pg replacement for events * Apply suggestions from code review Co-authored-by: rosstimothy <[email protected]> * Update docs/pages/reference/backends.mdx Co-authored-by: Paul Gottschling <[email protected]> * address feedback * Update docs/pages/reference/backends.mdx Co-authored-by: rosstimothy <[email protected]> --------- Co-authored-by: rosstimothy <[email protected]> Co-authored-by: Paul Gottschling <[email protected]>
gravitational · Aug 5, 2024 · a2d87db · a2d87db
1 parent 79933a9
commit a2d87db
Showing 1 changed file with 13 additions and 15 deletions.
diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/backends.mdx
@@ -10,12 +10,12 @@ For self-hosted Teleport deployments, you can configure Teleport to integrate
 with other storage types based on the nature of the stored data (size,
 read/write ratio, mutability, etc.).
 
-| Data type | Description | Supported storage backends |
-| - | - | - |
-| core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB |
-| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, AWS DynamoDB, GCP Firestore |
-| session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage |
-| teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret |
+| Data type               | Description                                                                                                                                 | Supported storage backends                                                                             |
+|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|
+| core cluster state      | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB                |
+| audit events            | JSON-encoded events from the audit log (e.g. user logins, RBAC changes)                                                                     | Local directory, PostgreSQL, CockroachDB, Amazon DynamoDB, GCP Firestore |
+| session recordings      | Raw terminal recordings of interactive user sessions                                                                                        | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage         |
+| teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy)                                                                       | Local directory, Kubernetes Secret                                                                     |
 
 ## Cluster state
 
@@ -209,6 +209,13 @@ its repository. The plugin is pre-installed with no extra steps to take in
 [Azure Database for
 PostgreSQL](https://azure.microsoft.com/en-us/products/postgresql).
 
+<Admonition type="note">
+CockroachDB can be used as a PostgreSQL drop-in replacement to store audit events (requires Teleport version >= 15.4.2).
+
+Teleport can store the cluster state in CockroachDB but this require CockroachDB-specific configuration.
+See the [CockroachDB backend section](#cockroachdb) for more details.
+</Admonition>
+
 Teleport needs separate databases for the cluster state and the
 audit log, and it will attempt to create them if given permissions to do so; it
 will also set up the database schemas as needed, so we recommend giving the user
@@ -1453,15 +1460,6 @@ to achieve high availability and survive regional failures. You must take steps
 protect access to CockroachDB in this configuration because that is where Teleport
 secrets like keys and user records will be stored.
 
-<Admonition
-  type="warning"
-  title="IMPORTANT"
->
-  CockroachDB can currently only be used to store Teleport's cluster state.
-  It cannot be used for Teleport's audit log in the same way that
-  [DynamoDB](#dynamodb) or [Firestore](#firestore) can.
-</Admonition>
-
 At a minimum you must configure CockroachDB to allow Teleport to create tables.
 Teleport will create the database if given permission to do so but this is not
 required if the database already exists.