Proxy HA Configuration

[russjones]

Problem

Teleport supports running multiple proxies in a highly available configuration (HA). To accomplish this you need to set nodename to be the same for all proxies and when each proxy starts up and generates a host certificate, they will all have the same canonical name listed in the list of principals on the certificate. Once all proxies report the same canonical name, you have two options:

1. Create a A record for the canonical name that points to a layer 4 load balancer (LB) and put all the proxies behind the LB.
2. Create multiple A records that point to the different IPs of the proxies.

The only downside is you lose access to connect to a single proxy directly because you if you create a DNS record for the specific proxy, the certificate it will present will have a different principal name and connecting to it will fail.

Proposed Solution

SSH host certificates support multiple values in the principals field. Teleport should add a parameter to the proxy_service section called ha_hostname that will be included in the list of principals. This will allow users to connect to a individual proxy directly or a proxy behind a LB.

For example suppose you had a cluster example.com and you had the following two proxies:

teleport:
  nodename: proxy1

proxy_service:
  enabled: yes

  public_addr: proxy

teleport:
  nodename: proxy2

proxy_service:
  enabled: yes

  public_addr: proxy

Then both would have proxy.example.com listed in the principals as well as proxy1.example.com and proxy2.example.com.

When updating this value, Teleport should update the certificates on disk as well the list of valid principals has changed. Otherwise users would have to throw away /var/lib/teleport each time they updated ha_hostname. This also has the side benefit of helping during DNS re-factoring.

[klizhentas]

Respect public_addr when issuing principals list for proxy.

[kontsevoy]

I am not a fan of ha_hostname. How about public_addr? It already exists, and we should use it for CLI output for tctl user add as well (or teleport status) basically any time .

IMORTANT: docs will need to be udpated for it.