Can't login with tsh to local Community Edition Teleport deployment

[nesmanriquecelonis]

I'm trying to run a PoC locally with kind and the Community Edition of Teleport. I installed an ingress-nginx in the cluster as well and then used teleport's helm chart (v16.0.4) with the following values:

chartMode: standalone
clusterName: teleport-poc.local.nestormanrique.com

kubeClusterName: teleport-poc

namespace: teleport

service:
  type: ClusterIP

ingress:
  enabled: true

proxyListenerMode: multiplex

log:
  level: DEBUG

I also created a local admin user.

kind: user
version: v2
metadata:
  name: admin
spec:
  roles:
    - access
    - editor

kubectl -n teleport exec -ti deployment/teleport-auth -- tctl create -f < manifests/teleport/user-admin.yaml

I used the given URL to put a password and MFA to the user, afterwards I checked and login in through the browser works fine but when I try to do the same with the CLI I get the following error:

tsh login --insecure --proxy=teleport-poc.local.nestormanrique.com:443 --user=admin teleport-poc.local.nestormanrique.com
Enter password for Teleport user admin:
WARNING: You are using insecure connection to Teleport proxy https://teleport-poc.local.nestormanrique.com:443
Enter an OTP code from a device:
ERROR: This server does not implement this feature yet. Likely the client version you are using is newer than the server. The server version: 16.0.4, the client version: 16.0.4. Please upgrade the server.
	unexpected HTTP status code received from server: 404 (Not Found); transport: received unexpected content-type "text/html"

The domain you see is only pointing to localhost, which works fine and I can reach the service without a problem, which is proven through the browser. I intentionally didn't setup acme because this is supposed to be for a short lived local demo and I don't want to complicate the setup too much.

However not being able to login through tsh is certainly painful for the rest of the things I wanna test. Any pointers on this would be helpful.

[stevenGravy]

Please make sure your tsh version matches the teleport version you are deploying.

[nesmanriquecelonis]

Please make sure your tsh version matches the teleport version you are deploying.

Hello, I made sure of that. The error output I shared above also states that both versions are the same.

[stevenGravy]

Something else is wrong then. Please share the versions you are using

[nesmanriquecelonis]

I'm using server and client version: 16.0.4.

[nesmanriquecelonis]

To give this topic a closure I'll describe what I did to make it work.

I was trying to run teleport behind an ingress controller in my local kubernetes setup with kind, which proved to be more complicated than expected. To make this work with self signed certs I had to:

• Change the whole setup to work with NodePort service and remove the ingress controller
• Disable multiplexing
• Forward the proper ports through extraPortMappings config in kind
• Make sure the --insecure flag was added to all teleport components (server, agent and operator). Note: the operator chart does not include this option so had to add it to the deployment directly (through kustomize overlay patch).
• I used a DNS record pointing to 127.0.0.1 in the clusterName setting i.e. teleport-poc.local.mydomain.com for convenience
• Ran a second kind cluster with an agent with a static token, proxyAddr = teleport-poc.local.mydomain.com:443 and added a hostAliases entry to the StatefulSet of the agent with teleport-poc.local.mydomain.com pointing to the IP of the gateway of your docker network. This last point depends on the system where you are running docker, in my case I'm in macos so it was the IP of whatever host.docker.internal resolves to.

With all this I got a working local setup with several clusters and running tsh login --insecure --proxy=localhost:3080 --auth=local --user=myuser teleport-poc.local.mydomain.com working as expected.