Skip to content

Commit 5e4710a

Browse files
sgtojsgtoj
authored
Merge pull request #9 from cruxstack/v14-support
feat: add support for tp v14
2 parents a16b6d3 + b32ac9c commit 5e4710a

File tree

12 files changed

+124
-87
lines changed

12 files changed

+124
-87
lines changed

‎.devcontainer/Dockerfile‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,18 @@
11
FROM mcr.microsoft.com/devcontainers/base:jammy
22

3+
RUN apt update && apt install -y \
4+
vim
5+
36
# install aws
47
RUN SYSTEM_ARCH=$(uname -m) \
5-
&& curl "https://awscli.amazonaws.com/awscli-exe-linux-${SYSTEM_ARCH}.zip" -o "awscliv2.zip" \
6-
&& unzip awscliv2.zip \
8+
&& curl "https://awscli.amazonaws.com/awscli-exe-linux-${SYSTEM_ARCH}-2.13.33.zip" -o "awscliv2.zip" \
9+
&& unzip -qq awscliv2.zip \
710
&& aws/install \
811
&& aws --version \
912
&& rm -rf aws
1013

1114
# install terraform
12-
ENV TERRAFORM_VERSION=1.5.1
15+
ENV TERRAFORM_VERSION=1.6.3
1316
ENV TF_PLUGIN_CACHE_DIR=$HOME/.terraform.d/plugin-cache
1417
RUN mkdir -p $TF_PLUGIN_CACHE_DIR
1518
RUN SYSTEM_ARCH=$(dpkg --print-architecture) \
@@ -45,5 +48,5 @@ RUN python3 -m pip install \
4548
black
4649

4750
# verify installs
48-
RUN terraform --version \
49-
&& aws --version
51+
RUN terraform --version
52+

‎.devcontainer/devcontainer.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"name": "Terraform",
33
"dockerFile": "Dockerfile",
44
"features": {
5-
"ghcr.io/devcontainers/features/docker-in-docker:2.5.0": {}
5+
"ghcr.io/devcontainers/features/docker-in-docker:2.7.1": {}
66
},
77
"mounts": [
88
"source=${localEnv:HOME}/.aws,target=/home/vscode/.aws,type=bind,consistency=cached",

‎README.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@
22

33
This Terraform module deploys a Teleport cluster in high availability (HA)
44
configuration. [Teleport](https://github.com/gravitational/teleport) is a modern
5-
zero-trust solution by Gravitational.
5+
zero-trust solution by Gravitational. This module has been tested with Teleport
6+
version v10 and v14.
67

78
### Features
89

@@ -15,6 +16,8 @@ zero-trust solution by Gravitational.
1516
corresponding increase in complexity.
1617
- **Integrated**: Works well with your existing infrastructure by following
1718
CloudPosse's context and labeling patterns.
19+
- **Automation** to create teleport connection to resources on-demand via
20+
included submodules.
1821

1922
## Usage
2023

@@ -27,7 +30,7 @@ module "teleport_cluster" {
2730
version = "x.x.x"
2831
2932
teleport_letsencrypt_email = "[email protected]"
30-
teleport_runtime_version = "10.3.15"
33+
teleport_runtime_version = "14.3.3"
3134
teleport_setup_mode = false
3235
dns_parent_zone_id = "Z0000000000000000000"
3336
dns_parent_zone_name = "demo.example.com"

‎modules/teleport-db-login/README.md‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ module "teleport_db_login" {
2020
source = "cruxstack/teleport-cluster/aws//modules/teleport-db-login"
2121
version = "x.x.x"
2222
23-
target_cluster = "your-target-cluster.teleport.example.com"
24-
target_db = "your-target-database"
23+
tp_cluster = "your-target-cluster.teleport.example.com"
24+
target_db = "your-target-database"
2525
}
2626
2727
# configure pgsql (eg, `cyrilgdn/postgresql`) provider to connect to the db
@@ -51,10 +51,13 @@ provider "postgresql" {
5151

5252
## Inputs
5353

54-
| Name | Description | Type | Default | Required |
55-
|------------------|----------------------------------------------------------|----------|---------|:--------:|
56-
| `target_cluster` | Domain to the Teleport cluster for database login. | `string` | n/a | yes |
57-
| `target_db` | Name of the target database within the Teleport cluster. | `string` | n/a | yes |
54+
| Name | Description | Type | Default | Required |
55+
|------------------|-------------------------------------------------------------------|----------|---------|:--------:|
56+
| `tp_proxy` | Domain to the Teleport cluster proxy for database login. | `string` | "" | no |
57+
| `tp_cluster` | Domain to the Teleport cluster for database login. | `string` | n/a | yes |
58+
| `target_db` | Name of the target database resource within the Teleport cluster. | `string` | n/a | yes |
59+
| `target_db_name` | Name of the database within the target database resource. | `string` | "" | no |
60+
| `target_db_user` | Name of the user to use when connecting to the database resource. | `string` | "" | no |
5861

5962
## Outputs
6063

‎modules/teleport-db-login/assets/tsh.sh‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,23 +4,29 @@ SCRIPT_EXIT_CODE=0
44
# --------------------------------------------------------------------- main ---
55

66
function db_login() {
7-
TSH_TARGET_CLUSTER=${1:?}
8-
TSH_TARGET_DB=${2:?}
9-
10-
tsh db login --cluster "${TSH_TARGET_CLUSTER}" "${TSH_TARGET_DB}" 1>/dev/null
11-
tsh db config --cluster "${TSH_TARGET_CLUSTER}" --format=json "${TSH_TARGET_DB}"
7+
TP_PROXY=${1:?}
8+
TP_CLUSTER=${2:?}
9+
TARGET_DB=${3:?}
10+
TARGET_DB_NAME=${4}
11+
TARGET_DB_USER=${5}
12+
13+
tsh db login --proxy "${TP_PROXY}" --cluster "${TP_CLUSTER}" "${TARGET_DB}" --db-name "${TARGET_DB_NAME:-"unset_db"}" --db-user "${TARGET_DB_USER:-"unset_user"}" 1>/dev/null
14+
tsh db config --proxy "${TP_PROXY}" --cluster "${TP_CLUSTER}" "${TARGET_DB}" --format=json
1215
}
1316

1417
# ------------------------------------------------------------------- script ---
1518

1619
if [[ "${1}" == "db-login" && "${2}" == "stdin" ]]; then
1720

1821
INPUT="$(dd 2>/dev/null)"
19-
TSH_TARGET_CLUSTER=$(echo "${INPUT}" | jq -r .target_cluster)
20-
TSH_TARGET_DB=$(echo "${INPUT}" | jq -r .target_db)
2122

23+
TP_PROXY=$(echo "${INPUT}" | jq -r .tp_proxy)
24+
TP_CLUSTER=$(echo "${INPUT}" | jq -r .tp_cluster)
25+
TARGET_DB=$(echo "${INPUT}" | jq -r .target_db)
26+
TARGET_DB_NAME=$(echo "${INPUT}" | jq -r .target_db_name)
27+
TARGET_DB_USER=$(echo "${INPUT}" | jq -r .target_db_user)
2228

23-
db_login "${TSH_TARGET_CLUSTER}" "${TSH_TARGET_DB}" | jq 'walk(if type =="number" then tostring else . end)' | jq -c .
29+
db_login "${TP_PROXY}" "${TP_CLUSTER}" "${TARGET_DB}" "${TARGET_DB_NAME}" "${TARGET_DB_USER}" | jq 'walk(if type =="number" then tostring else . end)' | jq -c .
2430

2531
else
2632

‎modules/teleport-db-login/main.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,8 @@ data "external" "db_connection_info" {
1515
]
1616

1717
query = {
18-
target_cluster = var.target_cluster
19-
target_db = var.target_db
18+
tp_proxy = coalesce(var.tp_proxy, var.tp_cluster)
19+
tp_cluster = var.tp_cluster
20+
target_db = var.target_db
2021
}
2122
}

‎modules/teleport-db-login/variables.tf‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,27 @@
1-
variable "target_cluster" {
1+
variable "tp_proxy" {
2+
type = string
3+
description = "Domain to the Teleport cluster proxy for database login."
4+
default = ""
5+
}
6+
7+
variable "tp_cluster" {
28
type = string
39
description = "Domain to the Teleport cluster for database login."
410
}
511

612
variable "target_db" {
713
type = string
8-
description = "Name of the target database within the Teleport cluster."
14+
description = "Name of the target database resource within the Teleport cluster."
15+
}
16+
17+
variable "target_db_name" {
18+
type = string
19+
description = "Name of the database within the target database resource."
20+
default = ""
21+
}
22+
23+
variable "target_db_user" {
24+
type = string
25+
description = "Name of the user to use when connecting to the database resource."
26+
default = ""
927
}

‎modules/teleport-node/main.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -966,4 +966,3 @@ resource "aws_lb_listener" "proxy_web" {
966966
type = "forward"
967967
}
968968
}
969-

‎modules/teleport-ssh-tunnel/README.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,13 @@ provider "redshift" {
4242

4343
## Inputs
4444

45-
| Name | Description | Type | Default | Required |
46-
|---------------------|--------------------------|----------|---------|:--------:|
47-
| `terraform_cluster` | Teleport cluster domain. | `string` | n/a | yes |
48-
| `terraform_gateway` | Teleport gateway. | `string` | n/a | yes |
49-
| `target_host` | Target host. | `string` | n/a | yes |
50-
| `target_port` | Target port. | `number` | n/a | yes |
45+
| Name | Description | Type | Default | Required |
46+
|-------------------|----------------------------------------------------------|----------|---------|:--------:|
47+
| `tp_proxy` | Domain to the Teleport cluster proxy for database login. | `string` | "" | no |
48+
| `tp_cluster` | Domain to the Teleport cluster for database login. | `string` | n/a | yes |
49+
| `tp_gateway_node` | Teleport node to use as the gateway for the connection. | `string` | n/a | yes |
50+
| `target_host` | Target user. | `number` | n/a | yes |
51+
| `target_port` | Target port. | `number` | n/a | yes |
5152

5253
## Outputs
5354

‎modules/teleport-ssh-tunnel/assets/tunneler.sh‎

Lines changed: 42 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -25,37 +25,28 @@ function get_random_ephemeral_port() {
2525
}
2626

2727
function get_gateway_address() {
28-
TELEPORT_CLUSTER=${1:?}
29-
TELEPORT_GATEWAY_NAME=${2:?}
30-
31-
NODE_HOST=$(
32-
tsh ls --cluster "${TELEPORT_CLUSTER}" \
33-
--query="labels[\"service\"] == \"${TELEPORT_GATEWAY_NAME}\"" \
28+
TP_PROXY=${1:?}
29+
TP_CLUSTER=${2:?}
30+
TP_GATEWAY_NODE=${3:?}
31+
TP_GATEWAY_USER=${4:-root}
32+
33+
TUNNEL_GATEWAY_HOST=$(
34+
tsh ls --proxy "${TP_PROXY}" --cluster "${TP_CLUSTER}" \
35+
--query="labels[\"service\"] == \"${TP_GATEWAY_NODE}\"" \
3436
--format names | head -n 1
3537
)
36-
echo "root@${NODE_HOST}"
37-
}
38-
39-
function open_tunnel() {
40-
TSH_CLUSTER_NAME=${1:?}
41-
TUNNEL_LOCAL_PORT=${2:?}
42-
TUNNEL_TARGET_HOST=${3:?}
43-
TUNNEL_TARGET_PORT=${4:?}
44-
TUNNEL_GATEWAY_ADDRESS=${5:?}
45-
46-
tsh ssh --cluster "${TSH_CLUSTER_NAME}" \
47-
-N -L "${TUNNEL_LOCAL_PORT}:${TUNNEL_TARGET_HOST}:${TUNNEL_TARGET_PORT}" \
48-
"${TUNNEL_GATEWAY_ADDRESS}"
38+
echo "${TP_GATEWAY_USER}@${TUNNEL_GATEWAY_HOST}"
4939
}
5040

5141
function open_background_tunnel() {
52-
TSH_CLUSTER_NAME=${1:?}
53-
TUNNEL_LOCAL_PORT=${2:?}
54-
TUNNEL_TARGET_HOST=${3:?}
55-
TUNNEL_TARGET_PORT=${4:?}
56-
TUNNEL_GATEWAY_ADDRESS=${5:?}
57-
58-
tsh ssh --cluster "${TSH_CLUSTER_NAME}" \
42+
TP_PROXY=${1:?}
43+
TP_CLUSTER=${2:?}
44+
TUNNEL_LOCAL_PORT=${3:?}
45+
TUNNEL_TARGET_HOST=${4:?}
46+
TUNNEL_TARGET_PORT=${5:?}
47+
TUNNEL_GATEWAY_ADDRESS=${6:?}
48+
49+
tsh ssh --proxy "${TP_PROXY}" --cluster "${TP_CLUSTER}" \
5950
-N -L "${TUNNEL_LOCAL_PORT}:${TUNNEL_TARGET_HOST}:${TUNNEL_TARGET_PORT}" \
6051
"${TUNNEL_GATEWAY_ADDRESS}" &
6152
TUNNEL_PID=$!
@@ -74,11 +65,12 @@ function open_background_tunnel() {
7465
}
7566

7667
function open_background_tunnel_with_timeout() {
77-
TSH_CLUSTER_NAME=${1:?}
78-
TUNNEL_LOCAL_PORT=${2:?}
79-
TUNNEL_TARGET_HOST=${3:?}
80-
TUNNEL_TARGET_PORT=${4:?}
81-
TUNNEL_GATEWAY_ADDRESS=${5:?}
68+
TP_PROXY=${1:?}
69+
TP_CLUSTER=${2:?}
70+
TUNNEL_LOCAL_PORT=${3:?}
71+
TUNNEL_TARGET_HOST=${4:?}
72+
TUNNEL_TARGET_PORT=${5:?}
73+
TUNNEL_GATEWAY_ADDRESS=${6:?}
8274
TUNNEL_TIMEOUT=${6:-$TUNNEL_TIMEOUT}
8375

8476
PARENT_PROCESS_ID="$(ps -p "${PPID}" -o "ppid=")"
@@ -87,7 +79,8 @@ function open_background_tunnel_with_timeout() {
8779
nohup timeout "${TUNNEL_TIMEOUT}" \
8880
"${SCRIPT_ROOT}/tunneler.sh" \
8981
"open_background_tunnel" \
90-
"${TSH_CLUSTER_NAME}" \
82+
"${TP_PROXY}" \
83+
"${TP_CLUSTER}" \
9184
"${TUNNEL_LOCAL_PORT}" \
9285
"${TUNNEL_TARGET_HOST}" \
9386
"${TUNNEL_TARGET_PORT}" \
@@ -109,16 +102,18 @@ function open_background_tunnel_with_timeout() {
109102
# --------------------------------------------------------------------- main ---
110103

111104
function create() {
112-
TELEPORT_CLUSTER=${1:?}
113-
TELEPORT_GATEWAY_NAME=${2:?}
114-
TUNNEL_TARGET_HOST=${3:?}
115-
TUNNEL_TARGET_PORT=${4:?}
105+
TP_PROXY=${1:?}
106+
TP_CLUSTER=${2:?}
107+
TP_GATEWAY_NODE=${3:?}
108+
TUNNEL_TARGET_HOST=${4:?}
109+
TUNNEL_TARGET_PORT=${5:?}
116110

117111
TUNNEL_LOCAL_PORT=$(get_random_ephemeral_port)
118-
TUNNEL_GATEWAY_ADDRESS=$(get_gateway_address "${TELEPORT_CLUSTER}" "${TELEPORT_GATEWAY_NAME}")
112+
TUNNEL_GATEWAY_ADDRESS=$(get_gateway_address "${TP_PROXY}" "${TP_CLUSTER}" "${TP_GATEWAY_NODE}")
119113

120114
open_background_tunnel_with_timeout \
121-
"${TELEPORT_CLUSTER}" \
115+
"${TP_PROXY}" \
116+
"${TP_CLUSTER}" \
122117
"${TUNNEL_LOCAL_PORT}" \
123118
"${TUNNEL_TARGET_HOST}" \
124119
"${TUNNEL_TARGET_PORT}" \
@@ -134,22 +129,23 @@ if [[ "${1}" == "create" && "${2}" == "stdin" ]]; then
134129
# handler if input is stdin (e.g. from terraform)
135130

136131
INPUT="$(dd 2>/dev/null)"
137-
TELEPORT_CLUSTER=$(echo "${INPUT}" | jq -r .teleport_cluster)
138-
TELEPORT_GATEWAY_NAME=$(echo "${INPUT}" | jq -r .teleport_gateway_name)
139-
TUNNEL_TARGET_HOST=$(echo "${INPUT}" | jq -r .target_host)
140-
TUNNEL_TARGET_PORT=$(echo "${INPUT}" | jq -r .target_port)
132+
TP_PROXY=$(echo "${INPUT}" | jq -r .tp_proxy)
133+
TP_CLUSTER=$(echo "${INPUT}" | jq -r .tp_cluster)
134+
TP_GATEWAY_NODE=$(echo "${INPUT}" | jq -r .tp_gateway_node)
135+
TARGET_HOST=$(echo "${INPUT}" | jq -r .target_host)
136+
TARGET_PORT=$(echo "${INPUT}" | jq -r .target_port)
141137

142-
TUNNEL_LOCAL_PORT=$(create "${TELEPORT_CLUSTER}" "${TELEPORT_GATEWAY_NAME}" "${TUNNEL_TARGET_HOST}" "${TUNNEL_TARGET_PORT}")
143-
echo "{\"host\":\"localhost\",\"port\":\"${TUNNEL_LOCAL_PORT}\"}"
138+
LOCAL_PORT=$(create "${TP_PROXY}" "${TP_CLUSTER}" "${TP_GATEWAY_NODE}" "${TARGET_HOST}" "${TARGET_PORT}")
139+
echo "{\"host\":\"localhost\",\"port\":\"${LOCAL_PORT}\"}"
144140

145141
elif [[ "${1}" == "create" ]]; then
146142

147143
# handler for normal cli calls
148144

149145
shift
150146

151-
TUNNEL_LOCAL_PORT=$(create "${@}")
152-
echo "localhost:${TUNNEL_LOCAL_PORT}"
147+
LOCAL_PORT=$(create "${@}")
148+
echo "localhost:${LOCAL_PORT}"
153149

154150
else
155151

0 commit comments

Comments
 (0)