Conversation
| system initially supporting DEB and RPM based distros that Teleport already | ||
| provides packages for. | ||
|
|
||
| To run commands on a VM, the Discovery Service will create a short-lived |
There was a problem hiding this comment.
How long will the key be valid for and what will happen to it after we're done with installation?
Is there a way to use SSH certificate authentication with the VMs instead of key pair?
There was a problem hiding this comment.
We can set an expiry on the key in the metadata (although it won't get deleted automatically).
I don't believe there's a way to use SSH cert authentication; creating key pairs is what GCP recommends.
| ssh key pair and add the public key to the VM via its metadata. Then it will | ||
| run the installer on the VM over SSH. | ||
|
|
||
| > Note: GCP VMs using [OS Login](https://cloud.google.com/compute/docs/oslogin) do not support SSH keys in instance metadata. |
There was a problem hiding this comment.
For OS Login enabled VMs, can Teleport generate some auth token and login as the IAM user? Not saying we should do it right away, just curious if there's such an option.
There was a problem hiding this comment.
AFAIK no, OS Login is only for Google accounts.
| provides packages for. | ||
|
|
||
| To run commands on a VM, the Discovery Service will create a short-lived | ||
| ssh key pair and add the public key to the VM via its metadata. Then it will |
There was a problem hiding this comment.
Does setting key in metadata take effect immediately?
| - [Verifying GCP VM Identity](https://cloud.google.com/compute/docs/instances/verifying-instance-identity) | ||
| - [SSH on GCP VMs](https://cloud.google.com/compute/docs/instances/ssh#third-party-tools) | ||
|
|
||
| ## Appendix I - Example ID token payload |
There was a problem hiding this comment.
Can you also include IaC flows in the scope of the RFD (whether any Helm charts, Kube operator or Terraform provider changes will be needed).
|
In the future, please try to follow the branch naming conventions for RFDs: Lines 68 to 70 in 785fa04 |
|
@strideynet @r0mant Mind taking another look at this? |
| state: draft | ||
| --- | ||
|
|
||
| # RFD X - GCP auto-discovery |
There was a problem hiding this comment.
Don't forget to assign the number.
|
|
||
| ## Required Approvers | ||
|
|
||
| Engineering: @jakule && @r0mant |
There was a problem hiding this comment.
I don't think Jakub is going to be able to review this anymore.
| Engineering: @jakule && @r0mant | |
| Engineering: @strideynet && @r0mant |
public-teleport-github-review-bot
Bot
removed request for
fspmarshall and
gzdunek
atburke
force-pushed
the
atburke/rfd-gcp-join
branch
from
4e4f706 to
e47c65b
Compare
4 participants
RFD for adding the ability to discover and automatically register GCP VMs, including a new
gcpjoin method.