tsh kube login fails

[jegger]

My setup:

• VM with teleport server installed (followed https://goteleport.com/docs/getting-started/)

• ingress port open: "3022", "3023", "3024", "3025", "3026", "3027", "3080", "443" (are they all needed?)

• egress port open: "80", "443"

• Deployed kube-agent with: helm install teleport-agent teleport/teleport-kube-agent --set kubeClusterName=exo-sks\ --set proxyAddr=<teleport-server-domain>:443 --set authToken=<generated by 'tctl nodes add --roles=kube --ttl=1h --format=json'> --create-namespace --namespace=teleport-agent

• Created the following role called 'kube-admin' to which the user I am logging in with is assigned to:

kind: role
metadata:
  id: 1621085278351098956
  name: kube-admin
spec:
  allow:
    app_labels:
      '*': '*'
    db_labels:
      '*': '*'
    kubernetes_groups:
    - system:masters
    kubernetes_labels:
      '*': '*'
    logins:
    - keep-this-value-here
    node_labels:
      '*': '*'
  deny: {}
  options:
    cert_format: standard
    enhanced_recording:
    - command
    - network
    forward_agent: false
    max_session_ttl: 8h0m0s
    port_forwarding: true
version: v3

When I try to auth to the cluster by:

1. tsh login
2. tsh kube login exo-sks I get the following error message: kubeconfig context "<teleport-server-domain>-exo-sks" not found.

• The kubeconfig file seems to be untouched.
• tsh kube ls lists the exo-sks cluster
• After the login I get the following back:

> Profile URL:        https://<teleport-sever-domain>:443
  Logged in as:       [email protected]
  Cluster:            <teleport-sever-domain>
  Roles:              access, admin, editor, kube-admin
  Logins:             keep-this-value-here
  Kubernetes:         disabled
  Valid until:        2021-05-16 00:02:36 +0200 CEST [valid for 8h0m0s]
  Extensions:         permit-agent-forwarding, permit-port-forwarding, permit-pty

• tctl get user/[email protected]

kind: user
metadata:
  id: 1621085425450530520
  name: [email protected]
spec:
  created_by:
    time: "2021-05-15T13:28:44.891522022Z"
    user:
      name: teleport-admin
  expires: "0001-01-01T00:00:00Z"
  roles:
  - access
  - admin
  - kube-admin
  - editor
  status:
    is_locked: false
    lock_expires: "0001-01-01T00:00:00Z"
    locked_time: "0001-01-01T00:00:00Z"
  traits:
    logins: null
version: v2

Any help in further debugging this would be very appreciated. I am evaluating teleport so I am not experienced yet / do not know where to look for hints.

Thanks

[jegger]

I think I was able to figure it out. Adding

proxy_service:
    kube_public_addr: <teleport-sever-domain>:3026
    kube_listen_addr: 0.0.0.0:3026

to the teleport.yaml configuration file of the authserver / proxy server did the trick!

[TySmith17]

Any chance you could share more of your config? im having a similar issue connecting to a kube agent, where the agent is never ever able to connect to the proxy.

[jegger]

That is the whole config. The helm chart values I've used are part of my initial question.

teleport:
  nodename: teleport
  data_dir: /var/lib/teleport
  log:
    output: stderr
    severity: INFO
  ca_pin: ""
auth_service:
  enabled: "yes"
  listen_addr: 0.0.0.0:3025
  cluster_name: <domain>
  authentication:
    type: local
ssh_service:
  enabled: "yes"
  labels:
    env: example
  commands:
  - name: hostname
    command: [hostname]
    period: 1m0s
proxy_service:
  enabled: "yes"
  listen_addr: 0.0.0.0:3023
  web_listen_addr: :443
  public_addr: <DOMAIN>:443
  kube_public_addr: <domain>:3026
  kube_listen_addr: 0.0.0.0:3026
  https_keypairs: []
  acme:
    enabled: "true"
    email: <email>