Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Docs: add discovery_group to teleport.yaml/discovery_service examples #48362

Merged
merged 3 commits into from
Nov 12, 2024
Merged

Docs: add discovery_group to teleport.yaml/discovery_service examples #48362

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
74bdf8a
Docs: add discovery_group to teleport.yaml/discovery_service examples
marcoandredinis Nov 4, 2024
8d03de1
explain discovery group
marcoandredinis Nov 7, 2024
7f9ba7a
use partial instead
marcoandredinis Nov 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion docs/pages/admin-guides/teleport-policy/integrations/aws-sync.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,6 @@ that are set up with the `discovery_group` matching
discovery_service:
enabled: true
discovery_group: <Var name="access-graph-disc" />

```

Notice that if you already operate a Discovery Service within your cluster,
Expand Down
8 changes: 0 additions & 8 deletions docs/pages/enroll-resources/auto-discovery/databases/databases.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,14 +75,6 @@ Here's an example database discovery configuration for the Discovery Service:
```yaml
discovery_service:
enabled: true
# discovery_group is used to group discovered resources into different
# sets. This is required when you have multiple Teleport Discovery services
# running. It prevents discovered services from colliding in Teleport when
# managing discovered resources.
# If two Discovery Services match the same resources, they must be in the
# same discovery group.
# If two Discovery Services match different resources, they must be in
# different discovery groups.
Comment on lines -78 to -85
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did you remove these explanations from everywhere? They seemed useful, discovery group is not an obvious concept to understand without the comment.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I removed them but added the (!docs/pages/includes/discovery/discovery-group.mdx!) partial where it was not already present.

I'm fine with either, but I think we should stick to only one form of documentation (either inline with the yaml code block or with the partial).

discovery_group: "disc-group"
# poll_interval is the cadence at which the discovery server will run each of its
# discovery cycles. The default is 5m.
Expand Down
2 changes: 2 additions & 0 deletions docs/pages/enroll-resources/auto-discovery/kubernetes/google-cloud.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -396,6 +396,7 @@ ssh_service:
enabled: off
discovery_service:
enabled: "yes"
discovery_group: "gke-myproject"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have any instructions telling the user to update discovery_group in this and other Teleport configuration examples?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have it in the reference page and some other configurations.
I can add it to everything.
The description we use in the reference page is:

    # discovery_group is used to group discovered resources into different
    # sets. This is required when you have multiple Teleport Discovery services
    # running. It prevents discovered services from colliding in Teleport when
    # managing discovered resources.
    # If two Discovery Services match the same resources, they must be in the
    # same discovery group.
    # If two Discovery Services match different resources, they must be in
    # different discovery groups.
    discovery_group: "disc-group"

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 I would just make it explicit how to assign this value. Is this the name of a Google Cloud project where Kubernetes clusters you want to discover are running?

Copy link
Contributor Author

@marcoandredinis marcoandredinis Nov 7, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's an opaque value. Can be a random string.
When multiple DiscoveryServices are running, it is used to ensure resources are not deleted when reconciling the list of resources (eg databases).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 I hadn't realized when leaving this comment that there is a partial, docs/pages/includes/discovery/discovery-group.mdx, that provides this information already. I think we can remove the discovery_group comments and use this partial instead.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed the inline comment in the yaml code blocks.
Added the partial where it was missing.

gcp:
- types: ["gke"]
locations: ["*"]
Expand Down Expand Up @@ -433,6 +434,7 @@ clusters in project `myproj-prod` running in `us-east2`, but *not* clusters in
```yaml
discovery_service:
enabled: "yes"
discovery_group: "gke-myproject"
gcp:
- types: ["gke"]
locations: ["us-east1"]
Expand Down
5 changes: 0 additions & 5 deletions docs/pages/enroll-resources/auto-discovery/kubernetes/kubernetes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,6 @@ and their default values.
# This section configures the Discovery Service
discovery_service:
enabled: "yes"
# discovery_group is used to group discovered resources into different
# sets. This is useful when you have multiple Teleport Discovery services
# running in the same cluster but polling different cloud providers or cloud
# accounts. It prevents discovered services from colliding in Teleport when
# managing discovered resources.
discovery_group: "prod"
aws:
# AWS resource types. Valid options are:
Expand Down
3 changes: 3 additions & 0 deletions docs/pages/enroll-resources/auto-discovery/servers/azure-discovery.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,8 @@ the Discovery Service.
In order to enable Azure instance discovery the `discovery_service.azure` section
of `teleport.yaml` must include at least one entry:

(!docs/pages/includes/discovery/discovery-group.mdx!)

```yaml
version: v3
teleport:
Expand All @@ -250,6 +252,7 @@ ssh_service:
enabled: off
discovery_service:
enabled: "yes"
discovery_group: "azure-prod"
azure:
- types: ["vm"]
subscriptions: ["<subscription>"]
Expand Down
3 changes: 3 additions & 0 deletions docs/pages/enroll-resources/auto-discovery/servers/ec2-discovery.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,8 @@ run the Discovery Service.
In order to enable EC2 instance discovery the `discovery_service.aws` section
of `teleport.yaml` must include at least one entry:

(!docs/pages/includes/discovery/discovery-group.mdx!)

```yaml
version: v3
teleport:
Expand All @@ -133,6 +135,7 @@ ssh_service:
enabled: off
discovery_service:
enabled: "yes"
discovery_group: "aws-prod"
aws:
- types: ["ec2"]
regions: ["us-east-1","us-west-1"]
Expand Down
3 changes: 3 additions & 0 deletions docs/pages/enroll-resources/auto-discovery/servers/gcp-discovery.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,8 @@ the Discovery Service.
In order to enable GCP instance discovery the `discovery_service.gcp` section
of `teleport.yaml` must include at least one entry:

(!docs/pages/includes/discovery/discovery-group.mdx!)

```yaml
version: v3
teleport:
Expand All @@ -246,6 +248,7 @@ ssh_service:
enabled: off
discovery_service:
enabled: "yes"
discovery_group: "gcp-prod"
gcp:
- types: ["gce"]
# The IDs of GCP projects that VMs can join from.
Expand Down
4 changes: 4 additions & 0 deletions docs/pages/includes/database-access/aws-troubleshooting-max-policy-size.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,12 @@ You can reduce the policy size by separating them into multiple IAM roles. Use
<TabItem label="Auto-Discovery by Discovery Service">
You can specify `assume_role_arn` in the AWS matchers of Discovery Service's
configuration:

(!docs/pages/includes/discovery/discovery-group.mdx!)

```yaml
discovery_service:
discovery_group: "prod"
enabled: "yes"
aws:
- types: ["rds"]
Expand Down
1 change: 1 addition & 0 deletions docs/pages/includes/server-access/custom-installer.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ Multiple `installer` resources can exist and be specified in the

```yaml
discovery_service:
# ...
{{ matcher }}:
- types: {{ matchTypes }}
tags:
Expand Down
2 changes: 2 additions & 0 deletions docs/pages/reference/agent-services/kubernetes-application-discovery.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@ Discovery Service, then restart the agents running these services.
Configuration for the Discovery Service is controlled by the `kubernetes` field,
example:

(!docs/pages/includes/discovery/discovery-group.mdx!)

```yaml
# This section configures the Discovery Service
discovery_service:
Expand Down
Loading