Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v16] Document that crdb can be used a a pg replacement for events #45071

Merged
merged 5 commits into from
Aug 5, 2024
Merged

[v16] Document that crdb can be used a a pg replacement for events #45071

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
843d822
Document that crdb can be used a a pg replacement for events
hugoShaka Jul 26, 2024
d7b0d0b
Apply suggestions from code review
hugoShaka Jul 29, 2024
a8d3e13
Update docs/pages/reference/backends.mdx
hugoShaka Jul 29, 2024
8f147a5
address feedback
hugoShaka Aug 2, 2024
404e524
Update docs/pages/reference/backends.mdx
hugoShaka Aug 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 13 additions & 15 deletions docs/pages/reference/backends.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,12 @@ For self-hosted Teleport deployments, you can configure Teleport to integrate
with other storage types based on the nature of the stored data (size,
read/write ratio, mutability, etc.).

| Data type | Description | Supported storage backends |
| - | - | - |
| core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB |
| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, AWS DynamoDB, GCP Firestore |
| session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage |
| teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret |
| Data type | Description | Supported storage backends |
|-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------|
| core cluster state | Cluster configuration (e.g. users, roles, auth connectors) and identity (e.g. certificate authorities, registered nodes, trusted clusters). | Local directory (SQLite), etcd, PostgreSQL, Amazon DynamoDB, GCP Firestore, CockroachDB |
| audit events | JSON-encoded events from the audit log (e.g. user logins, RBAC changes) | Local directory, PostgreSQL, CockroachDB, Amazon DynamoDB, GCP Firestore |
| session recordings | Raw terminal recordings of interactive user sessions | Local directory, AWS S3 (and any S3-compatible product), GCP Cloud Storage, Azure Blob Storage |
| teleport instance state | ID and credentials of a non-auth teleport instance (e.g. node, proxy) | Local directory, Kubernetes Secret |

## Cluster state

Expand Down Expand Up @@ -209,6 +209,13 @@ its repository. The plugin is pre-installed with no extra steps to take in
[Azure Database for
PostgreSQL](https://azure.microsoft.com/en-us/products/postgresql).

<Admonition type="note">
CockroachDB can be used as a PostgreSQL drop-in replacement to store audit events (requires Teleport version >= 15.4.2).

Teleport can store the cluster state in CockroachDB but this require CockroachDB-specific configuration.
See the [CockroachDB backend section](#cockroachdb) for more details.
</Admonition>

Teleport needs separate databases for the cluster state and the
audit log, and it will attempt to create them if given permissions to do so; it
will also set up the database schemas as needed, so we recommend giving the user
Expand Down Expand Up @@ -1453,15 +1460,6 @@ to achieve high availability and survive regional failures. You must take steps
protect access to CockroachDB in this configuration because that is where Teleport
secrets like keys and user records will be stored.

<Admonition
type="warning"
title="IMPORTANT"
>
CockroachDB can currently only be used to store Teleport's cluster state.
It cannot be used for Teleport's audit log in the same way that
[DynamoDB](#dynamodb) or [Firestore](#firestore) can.
</Admonition>

At a minimum you must configure CockroachDB to allow Teleport to create tables.
Teleport will create the database if given permission to do so but this is not
required if the database already exists.
Expand Down
Loading