Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v17] Remove Figure tags #52963

Open
wants to merge 1 commit into
base: branch/v17
Choose a base branch
from
Open

[v17] Remove Figure tags #52963

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions docs/pages/admin-guides/access-controls/guides/headless.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,15 +173,11 @@ Teleport Connect can also be used to approve Headless WebAuthn logins. Teleport
Connect will automatically detect the Headless WebAuthn login attempt and allow
you to approve or cancel the request.

<Figure width="700">
![Headless Confirmation](../../../../img/headless/confirmation.png)
</Figure>

You will be prompted to tap your MFA key to complete the approval process.

<Figure width="700">
![Headless WebAuthn Approval](../../../../img/headless/approval.png)
</Figure>

## Troubleshooting

Expand Down
35 changes: 14 additions & 21 deletions docs/pages/admin-guides/deploy-a-cluster/helm-deployments/digitalocean.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,15 +21,13 @@ cluster to Teleport.
## Step 1/4. Create a DigitalOcean Kubernetes cluster

Create a new [DigitalOcean Kubernetes Cluster](https://cloud.digitalocean.com/kubernetes/clusters/)
<Figure align="left" bordered caption="Create DigitalOcean Kubernetes cluster">
![Create DigitalOcean Kubernetes cluster](../../../../img/helm/digitalocean/create-k8s.png)
</Figure>

![Create DigitalOcean Kubernetes cluster](../../../../img/helm/digitalocean/create-k8s.png)

<br />
While the Kubernetes cluster is being provisioned, follow the "Getting Started" guide as shown below:
<Figure align="left" bordered caption="Set up DigitalOcean Kubernetes client">
![Set up DigitalOcean Kubernetes client](../../../../img/helm/digitalocean/setup-k8s.png)
</Figure>

![Set up DigitalOcean Kubernetes client](../../../../img/helm/digitalocean/setup-k8s.png)

## Step 2/4. Install Teleport

Expand Down Expand Up @@ -116,9 +114,8 @@ teleport-cluster-auth ClusterIP 10.245.164.28 <none> 3025/TC
```

Once you get the value for the external IP (it may take a few minutes for this field to be populated), update your DNS record such that the clusterName's A record points to this IP address. For example `192.168.200.200` is the external IP in the above case.
<Figure align="left" bordered caption="Configure DNS">
![Configure DNS](../../../../img/helm/digitalocean/fqdn.png)
</Figure>

![Configure DNS](../../../../img/helm/digitalocean/fqdn.png)

## Step 3/4. Create and set up Teleport user
Now we create a Teleport user by executing the `tctl` command with `kubectl`.
Expand Down Expand Up @@ -148,9 +145,8 @@ NOTE: Make sure tele.example.com:443 points at a Teleport proxy which users can
</Tabs>

Copy the link shown after executing the above command and open the link in a web browser to complete the user registration process (the link is `https://tele.example.com:443/web/invite/<invite-token>` in the above case).
<Figure align="left" bordered caption="Set up user">
![Set up user](../../../../img/helm/digitalocean/setup-user.png)
</Figure>

![Set up user](../../../../img/helm/digitalocean/setup-user.png)

After you complete the registration process by setting up a password and enrolling in multi-factor authentication, you will be logged in to Teleport Web UI.

Expand Down Expand Up @@ -179,14 +175,12 @@ $ kubectl --namespace=teleport-cluster exec -i deployment/teleport-cluster-auth

Now we will assign Teleport user **tadmin** with this role. The example below shows a process using Teleport Web UI:
First, lets select user edit menu:
<Figure align="left" bordered caption="Edit user">
![Edit user](../../../../img/helm/digitalocean/edit-user.png)
</Figure>

![Edit user](../../../../img/helm/digitalocean/edit-user.png)

Second, update the **tadmin** user role to assign the **member** role:
<Figure align="left" bordered caption="Update role">
![Update role](../../../../img/helm/digitalocean/update-role.png)
</Figure>

![Update role](../../../../img/helm/digitalocean/update-role.png)

We've updated the user **tadmin** to have the **member** role, which is allowed to access a Kubernetes cluster with privilege `system:master`.

Expand Down Expand Up @@ -263,9 +257,8 @@ teleport-cluster-6cc679b6f6-7xr5h 1/1 Running 0 14h
Voila! User **tadmin** was able to list the pods in their DigitalOcean Kubernetes cluster.

Teleport keeps an audit log of access to a Kubernetes cluster. In the screenshot below, the Teleport audit log shows that the user **tadmin** has logged into the cluster.
<Figure align="left" bordered caption="View audit log">
![View audit log](../../../../img/helm/digitalocean/view-activity.png)
</Figure>

![View audit log](../../../../img/helm/digitalocean/view-activity.png)

## Next steps

Expand Down
93 changes: 31 additions & 62 deletions docs/pages/admin-guides/deploy-a-cluster/helm-deployments/gcp.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,81 +39,62 @@ Go to the "Roles" section of Google Cloud IAM & Admin.

1. Click the "Create Role" button at the top.

<Figure align="left" bordered caption="Roles section">
![Roles section](../../../../img/helm/gcp/[email protected])
</Figure>
![Roles section](../../../../img/helm/gcp/[email protected])

2. Fill in the details of a "Storage Bucket Creator" role (we suggest using the name `storage-bucket-creator-role`)

<Figure align="left" bordered caption="Create role">
![Create role](../../../../img/helm/gcp/[email protected])
</Figure>
![Create role](../../../../img/helm/gcp/[email protected])

3. Click the "Add Permissions" button.

<Figure align="left" bordered caption="Storage bucket creator role">
![Storage bucket creator role](../../../../img/helm/gcp/[email protected])
</Figure>
![Storage bucket creator role](../../../../img/helm/gcp/[email protected])

4. Use the "Filter" box to enter `storage.buckets.create` and select it in the list.

<Figure align="left" bordered caption="Filter the list">
![Filter the list](../../../../img/helm/gcp/[email protected])
</Figure>
![Filter the list](../../../../img/helm/gcp/[email protected])

5. Check the `storage.buckets.create` permission in the list and click the "Add" button to add it to the role.

<Figure align="left" bordered caption="Select storage.buckets.create">
![Select storage.buckets.create](../../../../img/helm/gcp/[email protected])
</Figure>
![Select storage.buckets.create](../../../../img/helm/gcp/[email protected])

6. Once all these settings are entered successfully, click the "Create" button.

<Figure align="left" bordered caption="Create role">
![Create role](../../../../img/helm/gcp/[email protected])
</Figure>
![Create role](../../../../img/helm/gcp/[email protected])

### Create an IAM role granting Cloud DNS permissions

Go to the "Roles" section of Google Cloud IAM & Admin.

1. Click the "Create Role" button at the top.

<Figure align="left" bordered caption="Roles section">
![Roles section](../../../../img/helm/gcp/[email protected])
</Figure>
![Roles section](../../../../img/helm/gcp/[email protected])

2. Fill in the details of a "DNS Updater" role (we suggest using the name `dns-updater-role`)

<Figure align="left" bordered caption="Create role">
![Create role](../../../../img/helm/gcp/[email protected])
</Figure>
![Create role](../../../../img/helm/gcp/[email protected])

3. Click the "Add Permissions" button.

<Figure align="left" bordered caption="DNS updater role">
![DNS updater role](../../../../img/helm/gcp/[email protected])
</Figure>

4. Use the "Filter" box to find each of the following permissions in the list and add it.
You can type things like `dns.resourceRecordSets.*` to quickly filter the list.

```console
dns.resourceRecordSets.create
dns.resourceRecordSets.delete
dns.resourceRecordSets.list
dns.resourceRecordSets.update
dns.changes.create
dns.changes.get
dns.changes.list
dns.managedZones.list
```
![DNS updater role](../../../../img/helm/gcp/[email protected])

4. Use the "Filter" box to find each of the following permissions in the list
and add it. You can type things like `dns.resourceRecordSets.*` to quickly
filter the list.

```console
dns.resourceRecordSets.create
dns.resourceRecordSets.delete
dns.resourceRecordSets.list
dns.resourceRecordSets.update
dns.changes.create
dns.changes.get
dns.changes.list
dns.managedZones.list
```

5. Once all these settings are entered successfully, click the "Create" button.

<Figure align="left" bordered caption="Add DNS permissions">
![Add DNS permissions](../../../../img/helm/gcp/[email protected])
</Figure>
![Add DNS permissions](../../../../img/helm/gcp/[email protected])

### Create a service account for the Teleport Helm chart

Expand All @@ -127,15 +108,11 @@ Go to the "Service Accounts" section of Google Cloud IAM & Admin.

1. Click the "Create Service Account" button at the top.

<Figure align="left" bordered caption="Create service account">
![Create service account](../../../../img/helm/gcp/[email protected])
</Figure>
![Create service account](../../../../img/helm/gcp/[email protected])

2. Enter details for the service account (we recommend using the name `teleport-helm`) and click the "Create" button.

<Figure align="left" bordered caption="Enter service account details">
![Enter service account details](../../../../img/helm/gcp/[email protected])
</Figure>
![Enter service account details](../../../../img/helm/gcp/[email protected])

3. In the "Grant this service account access to project" section, add these four roles:

Expand All @@ -146,9 +123,7 @@ Go to the "Service Accounts" section of Google Cloud IAM & Admin.
| Cloud Datastore Owner | Grants permissions to create Cloud Datastore collections |
| Storage Object Admin | Allows read/write/delete of Google Cloud storage objects |

<Figure align="left" bordered caption="Add roles">
![Add roles](../../../../img/helm/gcp/[email protected])
</Figure>
![Add roles](../../../../img/helm/gcp/[email protected])

4. Click the "continue" button to save these settings, then click the "create" button to create the service account.

Expand All @@ -158,22 +133,16 @@ Go back to the "Service Accounts" view in Google Cloud IAM & Admin.

1. Click on the `teleport-helm` service account that you just created.

<Figure align="left" bordered caption="Click on the service account">
![Click on the service account](../../../../img/helm/gcp/[email protected])
</Figure>
![Click on the service account](../../../../img/helm/gcp/[email protected])

2. Click the "Keys" tab at the top and click "Add Key". Choose "JSON" and click "Create".

<Figure align="left" bordered caption="Create JSON key">
![Create JSON key](../../../../img/helm/gcp/11-createkey.png)
</Figure>
![Create JSON key](../../../../img/helm/gcp/11-createkey.png)

3. The JSON private key will be downloaded to your computer. Take note of the filename (`bens-demos-24150b1a0a7f.json` in this example)
as you will need it shortly.

<Figure align="left" bordered caption="Private key saved">
![Private key saved](../../../../img/helm/gcp/[email protected])
</Figure>
![Private key saved](../../../../img/helm/gcp/[email protected])

#### Create the Kubernetes secret containing the JSON private key for the service account

Expand Down
2 changes: 0 additions & 2 deletions docs/pages/admin-guides/deploy-a-cluster/linux-demo.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,8 @@ You can also get started right away with a production-ready Teleport cluster by
signing up for a [free trial of Teleport Enterprise
Cloud](https://goteleport.com/signup/).

<Figure width="700">
![Architecture of the setup you will complete in this
guide](../../../img/linux-server-diagram.png)
</Figure>

We will run the following Teleport services:

Expand Down
2 changes: 0 additions & 2 deletions docs/pages/admin-guides/management/export-audit-events/fluentd.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,7 @@ This guide also serves as an explanation for the Teleport Event Handler plugin,
using Fluentd as the target service. We'll create a local Docker container as a
destination for the Event Handler:

<Figure width="600">
![The Teleport Fluentd plugin](../../../../img/enterprise/plugins/fluentd-diagram.png)
</Figure>

You can follow the instructions below for a local proof-of-concept demo, or use any
of the additional installation instructions to configure the Teleport Event Handler
Expand Down
9 changes: 2 additions & 7 deletions docs/pages/admin-guides/management/guides/ec2-tags.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,22 +50,17 @@ To launch a new instance with instance metadata tags enabled:
1. Ensure that `Metadata accessible` is not disabled.
1. Enable `Allow tags in metadata`.

<Figure align="left" bordered caption="Advanced Options">
![Advanced Options](../../../../img/aws/launch-instance-advanced-options.png)
</Figure>

To modify an existing instance to enable instance metadata tags:

1. From the instance summary, go to `Actions > Instance Settings > Allow tags in instance metadata`.
1. Enable `Allow`.

<Figure align="left" bordered caption="Instance Settings">
![Instance Settings](../../../../img/aws/instance-settings.png)
</Figure>

<Figure align="left" bordered caption="Allow Tags">
1. Enable `Allow`.

![Allow Tags](../../../../img/aws/allow-tags.png)
</Figure>

### AWS CLI

Expand Down
8 changes: 0 additions & 8 deletions docs/pages/admin-guides/teleport-policy/integrations/entra-id.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,24 +110,18 @@ navigate to the "Access Management" tab, and choose "Enroll New Integration", th

In the onboarding wizard, choose a Teleport user that will be assigned as the default owner of Access Lists that are created for your Entra groups, and click "Next".

<Figure width="600">
![First step of the Entra ID integration onboarding](../../../../img/access-graph/entra-id/integration-wizard-step-1.png)
</Figure>

### Grant permissions in Azure and finish onboarding

The wizard will now provide you with a script that will set up the necessary permissions in Azure.

<Figure width="600">
![Second step of the Entra ID integration onboarding](../../../../img/access-graph/entra-id/integration-wizard-step-2.png)
</Figure>

Open Azure Cloud Shell by navigating to <a href="https://shell.azure.com">shell.azure.com</a>,
or by clicking the Cloud Shell icon in the Azure Portal.

<Figure width="600">
![Location of the Cloud Shell button in the Azure Portal](../../../../img/access-graph/entra-id/azure-cloud-shell-button.png)
</Figure>

Make sure to use the Bash version of Cloud Shell.
Once a Cloud Shell instance opens, paste the generated command.
Expand All @@ -141,9 +135,7 @@ it prints out the data required to finish the integration onboarding.

Back in the Teleport Web UI, fill out the required data and click "Finish".

<Figure width="600">
![Second step of the Entra ID integration onboarding with required fields filled in](../../../../img/access-graph/entra-id/integration-wizard-step-2-filled.png)
</Figure>

</TabItem>

Expand Down
2 changes: 0 additions & 2 deletions docs/pages/admin-guides/teleport-policy/policy-connections.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,9 +83,7 @@ When you inspect a particular user's access, the Teleport Access Graph will auto

To see more details about a specific database object, simply select it.

<Figure width="400">
![Details of an individual database object](../../../img/access-graph/dac/db-object-details.png)
</Figure>

In the graph, database objects are connected by multiple edges:

Expand Down
4 changes: 0 additions & 4 deletions docs/pages/connect-your-client/gui-clients.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -578,9 +578,7 @@ Test and create the connection.

The new connection should appear on the list.

<Figure width="400">
![SQL Developer (VS Code) Connected (basic)](../../img/database-access/guides/oracle/[email protected])
</Figure>

</TabItem>

Expand All @@ -607,9 +605,7 @@ Test and create the connection.

The new connection should appear on the list.

<Figure width="400">
![SQL Developer (VS Code) Connected (JDBC)](../../img/database-access/guides/oracle/[email protected])
</Figure>


</TabItem>
Expand Down
Loading
Loading