Direction for setting up TLS on the servers

[LuigiClemente]

Hello again, guys! I just wanted to thank you for the great work you've done on this project so far. I was wondering if you could help me out by pointing me in the right direction for setting up TLS on the servers. Micros OS is great for this purpose, but I used to use Ubuntu, and it worked really well with Teleport. Unfortunately, I haven't been able to install Teleport in the cluster this time around. I hope you guys are familiar with Gravitational Teleport or accessing clusters using TLS. Thanks a lot!

[ifeulner]

Not clear what you want to achieve, TLS for what?

[LuigiClemente]

I use Teleport to access servers and clusters, Teleport uses TLS. Teleport has lots of features and adds security, also open source.

[ifeulner]

Well, the API endpoint is always secured via TLS (TLS is "Transport Layer Security"... if you mean Teleport as this https://goteleport.com/kubernetes-access/ then it provides additional functionality like SSO, MFA, etc...

[mysticaltech]

@LuigiClemente By "not being able to install" what do you mean? See #697.

[LuigiClemente]

@mysticaltech See #697 spot on! Got it working, thank you very much!

[mysticaltech]

@LuigiClemente How did you get it to work? If you added SELinux rules locally, please let us know.

[LuigiClemente]

1. Install the SELinux policy development package:

sudo zypper install selinux-policy-devel

2. Create a new directory for the Teleport SELinux policy files:

sudo mkdir -p /usr/share/selinux/packages/teleport

3. Download the Teleport SELinux policy files from the Gravitational GitHub repository:

sudo curl -L https://github.com/gravitational/teleport/releases/latest/download/teleport-selinux-policy.tar.gz -o /tmp/teleport-selinux-policy.tar.gz

4. Extract the Teleport SELinux policy files to the newly created directory:

sudo tar -xzf /tmp/teleport-selinux-policy.tar.gz -C /usr/share/selinux/packages/teleport

5. Compile the Teleport SELinux policy files:

sudo make -C /usr/share/selinux/packages/teleport

6. Install the compiled Teleport SELinux policy files:

sudo semodule -i /usr/share/selinux/packages/teleport/teleport.pp

7. Reload the SELinux policy:

sudo load_policy

8. Finally, install Teleport:

sudo zypper install teleport

Teleport should be installed and running on your OpenSUSE MicroOS cluster with the necessary SELinux policies in place. I CREATED A CUSTOM SNAPSHOT IMAGE.

[mysticaltech]

Thanks for sharing! However, step 1 is not needed, this package is already installed I believe, and if it was needed, that's not the way, we cannot call zypper directly, it has to be through transactional-update.

And yes, teleport seems great. We will consider it!

[LuigiClemente]

I tried a few different stand alone.. I think I copied the wrong history..

[LuigiClemente]

Would this not be a great optional deployment feature? I think Teleport is banging!

[LuigiClemente]

To include Gravitational Teleport in your Packer build and create a MicroOS snapshot with Teleport, you can follow these steps:

1. Add the following line to your packages_to_install variable to include Teleport in the installation:

variable "packages_to_install" {
  type    = list(string)
  default = ["teleport"]
}

2. In the shell provisioner that installs packages, add the following commands to configure and start Teleport:

inline = [  local.needed_packages,  "systemctl enable teleport",  "systemctl start teleport",]

3. You can also add additional Teleport configuration files to your snapshot, such as the teleport.yaml configuration file. To do this, you can create a folder on your local machine containing the necessary files and add the following lines to your Packer build file:

source "file" "teleport-config" {
  # Path to the folder containing the Teleport configuration files
  # In this example, the folder is named "teleport-config" and is located in the same directory as the Packer build file
  # Change this path as necessary
  source_dir = "teleport-config"
}

build {
  # Other build steps...

  # Add the Teleport configuration files to the snapshot
  provisioner "file" {
    source      = ["source.file.teleport-config"]
    destination = "/etc/teleport"
  }
}

With these changes, your Packer build should include Gravitational Teleport and create a MicroOS snapshot with Teleport installed and configured.

[mysticaltech]

Superb, thanks for sharing!