This directory contains Docker-based flow to run Teleport clusters locally for testing & development purposes.
First, you need to build teleport:latest
Docker image.
Run the following commands from $GOPATH/github.com/gravitational/teleport
(repository base dir):
$ make docker
$ cd docker
$ make build
$ make up
This will start two Teleport clusters:
- Single-node cluster
one
, accessible now on https://localhost:3080 - Three-node cluster
two
, accessible now on https://localhost:5080
$ make down
SSH container needs User CA authorities exported:
$ make export-certs
Look at the Makefile: the containers are started with their
/var/lib/teleport
mounted to data/one
or data/two
on a host.
The configuration is passed via YAML files located in /teleport/docker/xxx.yaml
inside each container.
Since the cluster data is preserved between restarts, so you can edit the configuration and restart if you want to change configuration changes.
To add users to any of the clusters, you have to "enter" into the running
containers of their auth servers and use tctl
there.
For cluster "one":
$ make enter-one
and then you'll find yourself inside a container where teleport
auth daemon
is running, try ps -ef
for example and you'll get something like this:
container(one) /teleport: ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 40 06:04 ? 00:00:06 build/teleport start -c /teleport/docker/one.yaml
root 13 0 0 06:04 ? 00:00:00 /bin/bash
root 19 13 0 06:04 ? 00:00:00 ps -ef
For cluster "two":
$ make enter-two
... and then you can use stuff like tctl users add
, etc. Make sure to pass
the YAML file to tctl
via -c
flag.
-
Update
two-role.yaml
and replaceusername_goes_here
with your username. -
Create a
Role
andTrustedCluster
resource on Cluster Two.make enter-two tctl -c /root/go/src/github.com/gravitational/teleport/docker/two-auth.yaml create -f docker/two-role-admin.yaml tctl -c /root/go/src/github.com/gravitational/teleport/docker/two-auth.yaml create -f docker/two-tc.yaml
To setup Ansible:
-
Follow steps in Trusted Cluster section to setup Trusted Clusters.
-
Use
tctl
to issue create user command and follow link on screen to create user.tctl users add {username} root
-
Configure Ansible.
# add two-node to ansible hosts file echo "172.10.1.2:3022" >> /etc/ansible/hosts # setup ssh_args that ansible will use to access trusted cluster nodes sed -i '/ssh_args = -o ControlMaster=auto -o ControlPersist=60s/assh_args = -o "ProxyCommand ssh -p 3023 one -s proxy:%h:%p@two"' /etc/ansible/ansible.cfg # use scp over sftp sed -i '/scp_if_ssh/s/^#//g' /etc/ansible/ansible.cfg
-
Start and load OpenSSH agent with keys.
# create directory for ssh config mkdir ~/.ssh && chmod 700 ~/.ssh # start ssh-agent eval `ssh-agent` # log in with the user created before tsh --proxy=localhost --user=rjones login # load keys into ssh-agent tsh --proxy=localhost --user=rjones agent --load
-
Verify Ansible works:
$ ansible all -m ping 172.10.1.2 | success >> { "changed": false, "ping": "pong" }
-
Run an simple playbook:
# cd to directory that contains playbook cd /root/go/src/github.com/gravitational/teleport/docker/ansible # run playbook ansible-playbook playbook.yaml
Also you can start an empty container from which you can manually invoke teleport start
.
This is similar to launching an empty Linux VM with a Teleport binary.
To get shell inside the same "one" (single-node cluster) container without Teleport running:
$ make shell
NOTE: If you get "network already exists" error, do make stop
first.
Once inside, you'll get the same /var/lib/teleport
as "one", so you
can start (and even build) teleport
daemon manually. This container also
comes with a fully configured screen
so you can treat it as a real VM.