diff --git a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx b/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx index abe2e2a4ba415..431d441c9973e 100644 --- a/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx +++ b/docs/pages/admin-guides/deploy-a-cluster/helm-deployments/kubernetes-cluster.mdx @@ -198,12 +198,12 @@ chart. 1. Install the `teleport-cluster` Helm chart using the values file you wrote: - ```code - $ helm install teleport-cluster teleport/teleport-cluster \ - --create-namespace \ - --version (=teleport.version=) \ - --values teleport-cluster-values.yaml - ``` + ```code + $ helm install teleport-cluster teleport/teleport-cluster \ + --create-namespace \ + --version (=teleport.version=) \ + --values teleport-cluster-values.yaml + ``` 1. After installing the `teleport-cluster` chart, wait a minute or so and ensure that both the Auth Service and Proxy Service pods are running: diff --git a/docs/pages/admin-guides/deploy-a-cluster/hsm.mdx b/docs/pages/admin-guides/deploy-a-cluster/hsm.mdx index 438355b9fd6ae..bf627fcefcb0c 100644 --- a/docs/pages/admin-guides/deploy-a-cluster/hsm.mdx +++ b/docs/pages/admin-guides/deploy-a-cluster/hsm.mdx @@ -188,6 +188,7 @@ to use. DEBU[0000] preflight complete cert= config= key= pid=73502 seccomp=false serial= syslog=false timeout=0s version=3.0.3 DEBU[0000] takeoff TLS=false listen="localhost:12345" pid=73502 ``` + 1. Use `yubihsm-shell` to create a new authentication key to be used by Teleport with the necessary capabilities. diff --git a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted.mdx b/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted.mdx index 4bd874c64c678..382c020e67a73 100644 --- a/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted.mdx +++ b/docs/pages/enroll-resources/database-access/enroll-self-hosted-databases/mongodb-self-hosted.mdx @@ -34,6 +34,7 @@ videoBanner: 6lgVObxoLkc - (!docs/pages/includes/tctl.mdx!) + - A certificate authority for MongoDB Replica Set, and the public certificate for that CA, in PEM format: ``. You can also configure Teleport to trust this CA for standalone MongoDB instances. diff --git a/docs/pages/upgrading/automatic-agent-updates.mdx b/docs/pages/upgrading/automatic-agent-updates.mdx index 84de72dd84bb1..b1f869c3adfeb 100644 --- a/docs/pages/upgrading/automatic-agent-updates.mdx +++ b/docs/pages/upgrading/automatic-agent-updates.mdx @@ -317,10 +317,10 @@ This section assumes that the name of your `teleport-kube-agent` release is 1. Check for any deployment issues by checking the updater logs: - ```code - $ kubectl -n logs deployment/-updater - 2023-04-28T13:13:30Z INFO StatefulSet is already up-to-date, not updating. {"controller": "statefulset", "controllerGroup": "apps", "controllerKind": "StatefulSet", "StatefulSet": {"name":"my-agent","namespace":"agent"}, "namespace": "agent", "name": "my-agent", "reconcileID": "10419f20-a4c9-45d4-a16f-406866b7fc05", "namespacedname": "agent/my-agent", "kind": "StatefulSet", "err": "no new version (current: \"v12.2.3\", next: \"v12.2.3\")"} - ``` + ```code + $ kubectl -n logs deployment/-updater + 2023-04-28T13:13:30Z INFO StatefulSet is already up-to-date, not updating. {"controller": "statefulset", "controllerGroup": "apps", "controllerKind": "StatefulSet", "StatefulSet": {"name":"my-agent","namespace":"agent"}, "namespace": "agent", "name": "my-agent", "reconcileID": "10419f20-a4c9-45d4-a16f-406866b7fc05", "namespacedname": "agent/my-agent", "kind": "StatefulSet", "err": "no new version (current: \"v12.2.3\", next: \"v12.2.3\")"} + ``` ## Troubleshooting diff --git a/docs/pages/upgrading/upgrading-reference.mdx b/docs/pages/upgrading/upgrading-reference.mdx index d6635b32442e1..f802d28f1bda8 100644 --- a/docs/pages/upgrading/upgrading-reference.mdx +++ b/docs/pages/upgrading/upgrading-reference.mdx @@ -369,15 +369,15 @@ your `teleport-cluster` release is called `teleport-cluster`. 1. Update the Teleport Helm chart repository so you can install the latest version of the `teleport-cluster` chart: - (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!) + (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!) 1. Upgrade the `teleport-cluster` Helm release: - ```code - $ helm upgrade teleport-cluster teleport/teleport-cluster \ - --version= \ - --values=values.yaml - ``` + ```code + $ helm upgrade teleport-cluster teleport/teleport-cluster \ + --version= \ + --values=values.yaml + ``` The `teleport-cluster` Helm chart automatically waits for the previous version of the Proxy Service to stop responding to requests before running a @@ -395,7 +395,7 @@ that your `teleport-kube-agent` release is called `teleport-agent`. 1. Update the Teleport Helm chart repository so you can install the latest version of the `teleport-kube-agent` chart: - (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!) + (!docs/pages/includes/kubernetes-access/helm/helm-repo-add.mdx!) 1. Upgrade the Helm release: diff --git a/tool/tctl/common/edit_command.go b/tool/tctl/common/edit_command.go index 9317db74ce419..5c3b2f9efbdf4 100644 --- a/tool/tctl/common/edit_command.go +++ b/tool/tctl/common/edit_command.go @@ -44,10 +44,11 @@ import ( // EditCommand implements the `tctl edit` command for modifying // Teleport resources. type EditCommand struct { - app *kingpin.Application - cmd *kingpin.CmdClause - config *servicecfg.Config - ref services.Ref + app *kingpin.Application + cmd *kingpin.CmdClause + config *servicecfg.Config + ref services.Ref + confirm bool // Editor is used by tests to inject the editing mechanism // so that different scenarios can be asserted. @@ -61,9 +62,10 @@ func (e *EditCommand) Initialize(app *kingpin.Application, config *servicecfg.Co e.cmd.Arg("resource type/resource name", `Resource to update Type of a resource [for example: rc] Resource name to update - + Example: $ tctl edit rc/remote`).SetValue(&e.ref) + e.cmd.Flag("confirm", "Confirm an unsafe or temporary resource update").Hidden().BoolVar(&e.confirm) } func (e *EditCommand) TryRun(ctx context.Context, cmd string, client *authclient.Client) (bool, error) { @@ -115,6 +117,7 @@ func (e *EditCommand) editResource(ctx context.Context, client *authclient.Clien filename: f.Name(), force: true, withSecrets: true, + confirm: e.confirm, } rc.Initialize(e.app, e.config) diff --git a/tool/tctl/common/resource_command.go b/tool/tctl/common/resource_command.go index cf78b1835ff53..7bd410e86f3ea 100644 --- a/tool/tctl/common/resource_command.go +++ b/tool/tctl/common/resource_command.go @@ -710,6 +710,14 @@ func (rc *ResourceCommand) updateAuthPreference(ctx context.Context, client *aut return trace.Wrap(err) } + storedAuthPref, err := client.GetAuthPreference(ctx) + if err != nil { + return trace.Wrap(err) + } + if err := checkUpdateResourceWithOrigin(storedAuthPref, "cluster auth preference", rc.confirm); err != nil { + return trace.Wrap(err) + } + if _, err := client.UpdateAuthPreference(ctx, newAuthPref); err != nil { return trace.Wrap(err) } @@ -746,6 +754,14 @@ func (rc *ResourceCommand) updateClusterNetworkingConfig(ctx context.Context, cl return trace.Wrap(err) } + storedNetConfig, err := client.GetClusterNetworkingConfig(ctx) + if err != nil { + return trace.Wrap(err) + } + if err := checkUpdateResourceWithOrigin(storedNetConfig, "cluster networking configuration", rc.confirm); err != nil { + return trace.Wrap(err) + } + if _, err := client.UpdateClusterNetworkingConfig(ctx, newNetConfig); err != nil { return trace.Wrap(err) } @@ -804,6 +820,14 @@ func (rc *ResourceCommand) updateSessionRecordingConfig(ctx context.Context, cli return trace.Wrap(err) } + storedRecConfig, err := client.GetSessionRecordingConfig(ctx) + if err != nil { + return trace.Wrap(err) + } + if err := checkUpdateResourceWithOrigin(storedRecConfig, "session recording configuration", rc.confirm); err != nil { + return trace.Wrap(err) + } + if _, err := client.UpdateSessionRecordingConfig(ctx, newRecConfig); err != nil { return trace.Wrap(err) } @@ -2987,10 +3011,15 @@ func checkCreateResourceWithOrigin(storedRes types.ResourceWithOrigin, resDesc s if exists := (storedRes.Origin() != types.OriginDefaults); exists && !force { return trace.AlreadyExists("non-default %s already exists", resDesc) } - if managedByStatic := (storedRes.Origin() == types.OriginConfigFile); managedByStatic && !confirm { + return checkUpdateResourceWithOrigin(storedRes, resDesc, confirm) +} + +func checkUpdateResourceWithOrigin(storedRes types.ResourceWithOrigin, resDesc string, confirm bool) error { + managedByStatic := storedRes.Origin() == types.OriginConfigFile + if managedByStatic && !confirm { return trace.BadParameter(`The %s resource is managed by static configuration. We recommend removing configuration from teleport.yaml, restarting the servers and trying this command again. -If you would still like to proceed, re-run the command with both --force and --confirm flags.`, resDesc) +If you would still like to proceed, re-run the command with the --confirm flag.`, resDesc) } return nil }