Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v15] Machine ID: Document TBOT_USE_PROXY_ADDR #48674

Merged
merged 2 commits into from
Nov 8, 2024
Merged

[v15] Machine ID: Document TBOT_USE_PROXY_ADDR #48674

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fb28366
Document `TBOT_USE_PROXY_ADDR`
strideynet Nov 7, 2024
39204a9
"1" -> "yes"
strideynet Nov 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions docs/pages/enroll-resources/machine-id/troubleshooting.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,3 +320,18 @@ outputs:

Failure to add the `disable_exec_plugin` flag will result in a warning being displayed:
`Destination kubernetes_secret: identity-output must be a directory in exec plugin mode`.

## Configuring `tbot` for split DNS proxies

When you have deployed your Proxy Service in such a way that it is
accessible via two different DNS names, e.g an internal and external address,
you may find that a `tbot` that is configured to use one of these addresses may
attempt to use the other address and that this may cause connections to fail.

This is because `tbot` queries an auto-configuration endpoint exposed by the
Proxy Service to determine the canonical address to use when connecting.

To fix this, set a variable of `TBOT_USE_PROXY_ADDR=yes` in the environment of the
`tbot` process. This configures `tbot` to prefer using the address that you have
explicitly provided. This only functions correctly in cases where TLS
routing/multiplexing is enabled for the Teleport cluster.
Loading