Refresh the HA guide by ptgott · Pull Request #24479 · gravitational/teleport

ptgott · 2023-04-12T21:08:37Z

Update the HA guide to reflect v12 changes in the teleport-cluster Helm chart, e.g., running the Auth Service and Proxy Service in separate compute pools.

zmb3 · 2023-04-12T21:13:10Z

+  order to enable secure access to your Teleport cluster's infrastructure.

-We recommend configuring your load balancer to route traffic across multiple
+Neither load balancer must terminate TLS. Both load balancers must transparently


"Neither load balancer must" makes it sound like terminating TLS is optional and the LB doesn't have to, but can, terminate TLS.

Should we be stricter here and say "You must not terminate TLS on either of these load balancers"??

(That said, we technically do support ALBs for most protocols now..)

If the architectural changes you would need to support ALBs aren't too different from the setup we recommend in this guide, I think it would make sense to list the protocols that support ALBs now.

How would TLS termination work with ALBs, given that if they don't terminate TLS they wouldn't know whether they're receiving HTTP messages?

Paging @greedy52 who can answer this better than I can

Afaik:

Proxy -> Auth LB must not terminate TLS

Client -> Proxy LB can terminate TLS since 13.0 if the LB supports ALPN (but this might come with additional restrictions for kube access)

Thanks! What additional restrictions are these? Is there anything else I should know, @greedy52?

As mentioned, it doesn't support all protocols yet and it also has some performance penalties which we may do some performance improvement in v14. So I think layer 4 LBs should still be recommended way to set up HA.

I was planning to write up a separate page for TLS Routing behind layer 7 LB preview. Maybe I can add a note here to link to that page when it's available?

Sounds good! I'll keep the recommendation the way it is for now and we can add the note when the L7 guide is ready.

Suggest "Both load balancers must not" as a clearer phrasing.

I think "Both..must not" is ambiguous, since it can also mean "one can". I've suggested:

Both load balancers must transparently forward the TCP traffic they receive, without terminating TLS. In other words, these must be Layer 4 load balances, not Layer 7 (e.g., HTTP) load balancers.

zmb3 · 2023-04-12T21:14:47Z

-| `3023` | SSH port for clients connect to. |
+| <nobr>`3023`</nobr> | SSH port for clients connect to. |
 | `3024` | SSH port used to create reverse SSH tunnels from behind-firewall environments. |
 | `443` | HTTPS connections to authenticate `tsh` users into the cluster. The same connection is used to serve a Web UI. |


Do we specifically tell the user to configure the Teleport proxy to listen on port 443 in this guide?

Would it make more sense to list both the frontend and backend ports here, and have the LB direct incoming traffic on port 443 to port 3080 on the proxy? (Teleport would require additional privileges to bind to 443 as opposed to 3080)

Looks like there's no web_listen_addr example here. I'll change the LB instructions!

zmb3 · 2023-04-12T21:16:54Z

+load balancer to forward traffic from port `3025` to port `3025` on an available
+Auth Service instance. 
+
+If you are running your Teleport cluster on Kubernetes, you can configure your


Hmm, this confuses me a bit. Auth never listens on port 3026.

I'm basing this on the teleport-cluster chart, which enables the Kubernetes Service on Auth Service pods:

teleport/examples/chart/teleport-cluster/templates/auth/_config.common.tpl

Lines 5 to 8 in 64448b1

kubernetes_service:

enabled: true

listen_addr: 0.0.0.0:3026

public_addr: "{{ include "teleport-cluster.auth.serviceFQDN" . }}:3026"

Closes #22742 Update the HA guide to reflect v12 changes in the `teleport-cluster` Helm chart, e.g., running the Auth Service and Proxy Service in separate compute pools.

Remove mentions of running the Kubernetes Service on the Auth Service hosts

ptgott · 2023-04-25T21:23:49Z

@zmb3 Checking to see if there is more work I should be doing on this. It looks like @greedy52 will be adding separate docs for L7 LBs, and I've removed the Kubernetes-specific language.

Also paging @alexfornuto for a copy review.

Thanks!

alexfornuto · 2023-04-27T17:13:06Z

I suggest increasing the size of the "Developers" icon and text, I'm unable to read it when scaled into the page at my standard viewing (half a 1440 screen).

Since we still have some time in the quarter, I think it would make sense to replace this with a Mermaid diagram. We would need to get this PR approved, though: #25173

alexfornuto · 2023-04-27T17:14:34Z

+  order to enable secure access to your Teleport cluster's infrastructure.

-We recommend configuring your load balancer to route traffic across multiple
+Neither load balancer must terminate TLS. Both load balancers must transparently


Suggest "Both load balancers must not" as a clearer phrasing.

Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>

public-teleport-github-review-bot · 2023-05-04T21:45:45Z

@ptgott See the table below for backport results.

Branch	Result
branch/v12	Create PR
branch/v13	Create PR

ptgott added the backport/branch/v12 label Apr 12, 2023

github-actions Bot requested review from alexfornuto, r0mant, xinding33 and zmb3 April 12, 2023 21:08

github-actions Bot added documentation size/sm labels Apr 12, 2023

zmb3 reviewed Apr 12, 2023

View reviewed changes

ptgott requested review from hugoShaka and zmb3 April 14, 2023 15:24

zmb3 added the backport/branch/v13 label Apr 18, 2023

ptgott added 3 commits April 21, 2023 09:49

Refresh the HA guide

22c28ff

Closes #22742 Update the HA guide to reflect v12 changes in the `teleport-cluster` Helm chart, e.g., running the Auth Service and Proxy Service in separate compute pools.

Respond to zmb3 feedback

59b5beb

Respond to hugoShaka feedback

0a42eec

Remove mentions of running the Kubernetes Service on the Auth Service hosts

ptgott force-pushed the paul.gottschling/22742-ha branch from 1babb3a to 0a42eec Compare April 21, 2023 13:49

alexfornuto reviewed Apr 27, 2023

View reviewed changes

Respond to alexfornuto feedback

312ac68

ptgott requested review from alexfornuto and greedy52 April 28, 2023 16:30

greedy52 reviewed May 1, 2023

View reviewed changes

Comment thread docs/pages/deploy-a-cluster/high-availability.mdx Outdated

Update docs/pages/deploy-a-cluster/high-availability.mdx

74300f8

Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>

ptgott requested a review from greedy52 May 1, 2023 17:56

greedy52 approved these changes May 1, 2023

View reviewed changes

Comment thread docs/pages/deploy-a-cluster/high-availability.mdx Outdated

Update docs/pages/deploy-a-cluster/high-availability.mdx

01d2156

Co-authored-by: STeve (Xin) Huang <xin.huang@goteleport.com>

alexfornuto approved these changes May 4, 2023

View reviewed changes

public-teleport-github-review-bot Bot removed request for r0mant and xinding33 May 4, 2023 21:28

ptgott added this pull request to the merge queue May 4, 2023

Merged via the queue into master with commit cca1320 May 4, 2023

ptgott deleted the paul.gottschling/22742-ha branch May 4, 2023 21:44

This was referenced May 4, 2023

[v12] Refresh the HA guide #25670

Merged

[v13] Refresh the HA guide #25671

Merged

	kubernetes_service:
	enabled: true
	listen_addr: 0.0.0.0:3026
	public_addr: "{{ include "teleport-cluster.auth.serviceFQDN" . }}:3026"

Conversation

ptgott commented Apr 12, 2023

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hugoShaka Apr 17, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ptgott commented Apr 25, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

public-teleport-github-review-bot Bot commented May 4, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

hugoShaka Apr 17, 2023 •

edited

Loading