From d645db5bfcf7884ac377d55f000b3f948f95414e Mon Sep 17 00:00:00 2001 From: hugoShaka Date: Fri, 26 Jul 2024 15:44:24 -0400 Subject: [PATCH 1/5] Document that crdb can be used a a pg replacement for events --- docs/pages/reference/backends.mdx | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/backends.mdx index 310aee9d1a578..46d5a478f0009 100644 --- a/docs/pages/reference/backends.mdx +++ b/docs/pages/reference/backends.mdx @@ -13,7 +13,7 @@ read/write ratio, mutability, etc.). | Data type | Description | Supported storage backends | | - | - | - | | core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB | -| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, AWS DynamoDB, GCP Firestore | +| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL/CockroachDB, AWS DynamoDB, GCP Firestore | | session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage | | teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret | @@ -330,6 +330,13 @@ teleport: - postgresql://user_name@database-address/teleport_audit?sslmode=verify-full#disable_cleanup=false&retention_period=2160h ``` + +CockroachDB can be used as a Postgres drop-in replacement to store audit events (requires Teleport version >= 15.4.2). + +Teleport can store the core state in CockroachDB but this require CockroachDB-specific configuration. +See the [CockroachDB backend section](#cockroachdb) for more details. + + ### Authentication We strongly recommend using [client From 539661642a24ee0022db13ac95e819cbafdea2fa Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Mon, 29 Jul 2024 10:06:57 -0400 Subject: [PATCH 2/5] Apply suggestions from code review Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> --- docs/pages/reference/backends.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/backends.mdx index 46d5a478f0009..41b12ebfeae61 100644 --- a/docs/pages/reference/backends.mdx +++ b/docs/pages/reference/backends.mdx @@ -331,9 +331,9 @@ teleport: ``` -CockroachDB can be used as a Postgres drop-in replacement to store audit events (requires Teleport version >= 15.4.2). +CockroachDB can be used as a PostgreSQL drop-in replacement to store audit events (requires Teleport version >= 15.4.2). -Teleport can store the core state in CockroachDB but this require CockroachDB-specific configuration. +Teleport can store the cluster state in CockroachDB but this require CockroachDB-specific configuration. See the [CockroachDB backend section](#cockroachdb) for more details. From 5694ee26b23355ccbc9eb3d2e7380bd58b66b974 Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Mon, 29 Jul 2024 14:28:22 -0400 Subject: [PATCH 3/5] Update docs/pages/reference/backends.mdx Co-authored-by: Paul Gottschling --- docs/pages/reference/backends.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/backends.mdx index 41b12ebfeae61..2c1c0f9849932 100644 --- a/docs/pages/reference/backends.mdx +++ b/docs/pages/reference/backends.mdx @@ -13,7 +13,7 @@ read/write ratio, mutability, etc.). | Data type | Description | Supported storage backends | | - | - | - | | core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB | -| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL/CockroachDB, AWS DynamoDB, GCP Firestore | +| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL/CockroachDB, Amazon DynamoDB, GCP Firestore | | session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage | | teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret | From ad9d77d757299e7ca14a1586c7a167d9e4f060ec Mon Sep 17 00:00:00 2001 From: hugoShaka Date: Fri, 2 Aug 2024 16:27:11 -0400 Subject: [PATCH 4/5] address feedback --- docs/pages/reference/backends.mdx | 35 ++++++++++++------------------- 1 file changed, 13 insertions(+), 22 deletions(-) diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/backends.mdx index 2c1c0f9849932..a9e3d4312fc6a 100644 --- a/docs/pages/reference/backends.mdx +++ b/docs/pages/reference/backends.mdx @@ -10,12 +10,12 @@ For self-hosted Teleport deployments, you can configure Teleport to integrate with other storage types based on the nature of the stored data (size, read/write ratio, mutability, etc.). -| Data type | Description | Supported storage backends | -| - | - | - | -| core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB | -| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL/CockroachDB, Amazon DynamoDB, GCP Firestore | -| session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage | -| teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret | +| Data type | Description | Supported storage backends | +|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------| +| core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB | +| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, CockroachDB (as a PostgreSQL replacement), Amazon DynamoDB, GCP Firestore | +| session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage | +| teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret | ## Cluster state @@ -209,6 +209,13 @@ its repository. The plugin is pre-installed with no extra steps to take in [Azure Database for PostgreSQL](https://azure.microsoft.com/en-us/products/postgresql). + +CockroachDB can be used as a PostgreSQL drop-in replacement to store audit events (requires Teleport version >= 15.4.2). + +Teleport can store the cluster state in CockroachDB but this require CockroachDB-specific configuration. +See the [CockroachDB backend section](#cockroachdb) for more details. + + Teleport needs separate databases for the cluster state and the audit log, and it will attempt to create them if given permissions to do so; it will also set up the database schemas as needed, so we recommend giving the user @@ -330,13 +337,6 @@ teleport: - postgresql://user_name@database-address/teleport_audit?sslmode=verify-full#disable_cleanup=false&retention_period=2160h ``` - -CockroachDB can be used as a PostgreSQL drop-in replacement to store audit events (requires Teleport version >= 15.4.2). - -Teleport can store the cluster state in CockroachDB but this require CockroachDB-specific configuration. -See the [CockroachDB backend section](#cockroachdb) for more details. - - ### Authentication We strongly recommend using [client @@ -1460,15 +1460,6 @@ to achieve high availability and survive regional failures. You must take steps protect access to CockroachDB in this configuration because that is where Teleport secrets like keys and user records will be stored. - - CockroachDB can currently only be used to store Teleport's cluster state. - It cannot be used for Teleport's audit log in the same way that - [DynamoDB](#dynamodb) or [Firestore](#firestore) can. - - At a minimum you must configure CockroachDB to allow Teleport to create tables. Teleport will create the database if given permission to do so but this is not required if the database already exists. From dd578b5919b110cf9f3bd7d5b4b0701649d616c5 Mon Sep 17 00:00:00 2001 From: Hugo Shaka Date: Mon, 5 Aug 2024 10:05:42 -0400 Subject: [PATCH 5/5] Update docs/pages/reference/backends.mdx Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com> --- docs/pages/reference/backends.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/pages/reference/backends.mdx b/docs/pages/reference/backends.mdx index a9e3d4312fc6a..faf52ea888e62 100644 --- a/docs/pages/reference/backends.mdx +++ b/docs/pages/reference/backends.mdx @@ -13,7 +13,7 @@ read/write ratio, mutability, etc.). | Data type | Description | Supported storage backends | |-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------| | core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB | -| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, CockroachDB (as a PostgreSQL replacement), Amazon DynamoDB, GCP Firestore | +| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, CockroachDB, Amazon DynamoDB, GCP Firestore | | session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage | | teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret |