Multiple storages

[dorbian]

Hey all,

I'm trying to setup a HA implementation of Teleport on Openshift, currently the storage backend is ETCD for the audit log, however for session tracking I would like to use S3 storage.
Can I just add another storage: section in the configuration or is there another way of achieving this ?

[scottpgallagher]

For this use case using ETCD won't allow you to specify S3 in that fashion; see our docs here (in the important box): https://goteleport.com/docs/setup/reference/backends/#etcd

"etcd can only currently be used to store Teleport's internal database in a highly-available way. This will allow you to have multiple auth servers in your cluster for an High Availability deployment, but it will not also store Teleport audit events for you in the same way that DynamoDB or Firestore will. etcd is not designed to handle large volumes of time series data like audit events."

For the use case you want you will want to use dynamodb and s3 per the docs further down on that same page.

[dorbian]

Hey Scott, thanks for the reply, however I don't run the Openshift cluster on AWS, so no access to dynamodb.
I do think I already found the answer, still testing and will update once I found a working solution.

[dorbian]

Although not 100% sure yet, appending the S3 storage information to the configuration as is seems to have some desired results, without impacting the ETCD storage layer.
The container is clearly trying to create the storage bucket, however as we are using an S3 compliant storage system, it requires a bit more work.

[webvictim]

There are three separate locations for data when using Teleport:

• Backend database (this is the teleport.storage section in the config file, one location)
• Audit log (auth_service.audit_events_uri in the config file, one or more locations)
• Session recordings (auth_service.audit_sessions_uri in the config file, one or more locations)

Each of these can be configured to use a separate system, so it's absolutely possible to do things like using etcd for backend database, writing audit logs to syslog:// and then using S3 (or S3-like) storage for session recordings.

There's some information about this in our docs: https://goteleport.com/docs/setup/reference/backends

[MBilalRasool]

Hi,
I have a teleport cluster on My local server, I want its backend storage on AWS dynamodb.
can you guide me on this? I already gone through the teleport official documentation but keep getting errors.

[webvictim]

What error are you getting? Please share your config too.

[MBilalRasool]

I am getting this error, according to this, the issue is with self-signed certificate or certificate through an unknown authority.
But i generate and try certificate with "let encrypt and openssl".
I am configuring teleport backend to DynamoDB, and this error only appear when it make this change in configuration. Otherwise it works fine and redirect to HTTPS/cluster. The configuraiton is totally according to documentation

also teleport is able to create/store data in aws ( dynamodb)

now not sure from where i am getting this error.

[MBilalRasool]

teleport:
  storage:
    type: dynamodb
    region: us-east-1
 #   access_key_id: ${AWS_ACCESS_KEY_ID}
  #  secret_access_key: ${AWS_SECRET_ACCESS_KEY}
    table_name: "test123"
    audit_events_uri:  ['dynamodb://test234', 'file:///var/lib/teleport/audit/events', 'stdout://']
    audit_sessions_uri: "s3://teleportartifactsdata/teleport-artifacts/"
    retention_period: 365d
    billing_mode: "pay_per_request"
    continuous_backups: true
    path: /var/lib/teleport/backend/
  nodename: ip-***********
  data_dir: /var/lib/teleport
  log:
    output: stderr
    severity: INFO
    format:
      output: text
  ca_pin: ""
  diag_addr: ""
auth_service:
  enabled: "yes"
  proxy_protocol: on
  listen_addr: 0.0.0.0:3025
  cluster_name: -cluster
  proxy_listener_mode: multiplex
ssh_service:
  enabled: "yes"
  commands:
  - name: hostname
    command: [hostname]
    period: 1m0s
proxy_service:
  enabled: "yes"
  web_listen_addr: 0.0.0.0:3080
  public_addr: ***************:443
  https_keypairs:
  - key_file: /var/lib/teleport/private-key.pem
    cert_file: /var/lib/teleport/certificate.pem
  https_keypairs_reload_interval: 0s```