Adding New Resources

Pre-requisites

1. The resource has network access to the Teleport Cluster’s proxy (internal.production.teleport.gitlab.net).
2. The resource has access to a join method (default is GCP)

Adding virtual machines (via Chef)

1. Ensure that the gitlab-teleport cookbook is in the runlist (see chef-repo).
2. Ensure that the environment and service attributes are set.
3. Ensure that the join method is configured via the config attribute.

Note that the cookbook may also be used to deploy a Teleport bot service (Machine & Workload Identity).

Adding kubernetes resources (via Helm)

1. Add the new cluster resources to the Teleport Agent chart.
2. Ensure that the labels.environment and labels.service attributes are set.
3. Ensure that the join method is configured via the joinParams attribute.

Manual approach (avoid doing this, use IaC approaches instead)

1. On your local machine, log into tsh.
2. Use tctl tokens add --ttl=5m --type=node to generate a new token.
3. On the resource node, stop teleport with systemctl stop teleport.
4. On the resource node, edit the /etc/teleport/config.yaml file, and add the generated token to the token_name field.
5. Start up the teleport service again on the resource node: systemctl start teleport.

Updating Roles

Ensure that the labels applied to the resource match existing roles so that the correct users can access it.

If you have added a new db-type (for example), you may need to add it to existing roles defined in Terraform. Here is an example merge request to add the new sec db-type to existing roles.

Reference

Join Services with a Secure Token