diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/backends.mdx index 310aee9d1a578..faf52ea888e62 100644 --- a/docs/pages/reference/backends.mdx +++ b/docs/pages/reference/backends.mdx @@ -10,12 +10,12 @@ For self-hosted Teleport deployments, you can configure Teleport to integrate with other storage types based on the nature of the stored data (size, read/write ratio, mutability, etc.). -| Data type | Description | Supported storage backends | -| - | - | - | -| core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB | -| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, AWS DynamoDB, GCP Firestore | -| session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage | -| teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret | +| Data type | Description | Supported storage backends | +|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------| +| core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB | +| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, CockroachDB, Amazon DynamoDB, GCP Firestore | +| session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage | +| teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret | ## Cluster state @@ -209,6 +209,13 @@ its repository. The plugin is pre-installed with no extra steps to take in [Azure Database for PostgreSQL](https://azure.microsoft.com/en-us/products/postgresql). + +CockroachDB can be used as a PostgreSQL drop-in replacement to store audit events (requires Teleport version >= 15.4.2). + +Teleport can store the cluster state in CockroachDB but this require CockroachDB-specific configuration. +See the [CockroachDB backend section](#cockroachdb) for more details. + + Teleport needs separate databases for the cluster state and the audit log, and it will attempt to create them if given permissions to do so; it will also set up the database schemas as needed, so we recommend giving the user @@ -1453,15 +1460,6 @@ to achieve high availability and survive regional failures. You must take steps protect access to CockroachDB in this configuration because that is where Teleport secrets like keys and user records will be stored. - - CockroachDB can currently only be used to store Teleport's cluster state. - It cannot be used for Teleport's audit log in the same way that - [DynamoDB](#dynamodb) or [Firestore](#firestore) can. - - At a minimum you must configure CockroachDB to allow Teleport to create tables. Teleport will create the database if given permission to do so but this is not required if the database already exists.