Skip to content

Update docs with database user auto provisioning modes#33819

Merged
gabrielcorado merged 3 commits intomasterfrom
gabrielcorado/db-auto-provisioning-mode-docs
Oct 24, 2023
Merged

Update docs with database user auto provisioning modes#33819
gabrielcorado merged 3 commits intomasterfrom
gabrielcorado/db-auto-provisioning-mode-docs

Conversation

@gabrielcorado
Copy link
Copy Markdown
Contributor

@gabrielcorado gabrielcorado commented Oct 23, 2023

#32792 introduced a new role option to configure if provisioned database users should be kept (disabled) or dropped. This PR updates the auto-provisioning docs to add this new option.

Note: create_db_user will still work (true = keep and false = off), but it is preferred that users specify the mode (similar to the create_host_user_mode and create_host_user options).

@gabrielcorado gabrielcorado self-assigned this Oct 23, 2023
@gabrielcorado gabrielcorado temporarily deployed to vercel October 23, 2023 15:22 — with GitHub Actions Inactive
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Oct 23, 2023

🤖 Vercel preview here: https://docs-7fie2uuif-goteleport.vercel.app/docs/ver/preview

greedy52
greedy52 approved these changes Oct 23, 2023
View reviewed changes
Comment thread docs/pages/includes/role-spec.mdx
Comment thread docs/pages/access-controls/reference.mdx Outdated
greedy52
greedy52 reviewed Oct 24, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@greedy52 greedy52 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW, could you also align these text:

teleport/docs/pages/database-access/auto-user-provisioning/postgres.mdx

Lines 72 to 74 in a9c3182

Teleport will not delete the automatically created user at the end of the session.
Instead, the user will be stripped of all roles, updated with `nologin` trait
and reactivated during the next connection.

teleport/docs/pages/database-access/auto-user-provisioning/mysql.mdx

Lines 73 to 75 in a9c3182

Teleport will not delete the automatically created user at the end of the
session. Instead, the user will be stripped of all roles and the user account
will be locked.

Thanks!!

@gabrielcorado gabrielcorado temporarily deployed to vercel October 24, 2023 19:41 — with GitHub Actions Inactive
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Oct 24, 2023

The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with changelog: followed by the changelog entries for the PR.

@gabrielcorado
Copy link
Copy Markdown
Contributor Author

gabrielcorado commented Oct 24, 2023

@greedy52 I've removed those paragraphs from the pages since it is already mentioned in the "Create Teleport role" section.

@gabrielcorado gabrielcorado added the no-changelog Indicates that a PR does not require a changelog entry label Oct 24, 2023
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Oct 24, 2023

🤖 Vercel preview here: https://docs-5ag0ur5qd-goteleport.vercel.app/docs/ver/preview

ptgott
ptgott reviewed Oct 24, 2023
View reviewed changes
Comment thread docs/pages/includes/database-access/auto-user-provisioning-common-teleport-role.mdx Outdated
Comment thread docs/pages/access-controls/reference.mdx Outdated
| `cert_extensions` | Specifies extensions to be included in SSH certificates | |
| `create_host_user_mode` | Allow users to be automatically created on a host | Logical "AND" i.e. if all roles matching a server specify host user creation (`off`, `drop`, `keep`), it will evaluate to the option specified by all of the roles. If some roles specify both `drop` or `keep` it will evaluate to `keep`|
| `create_db_user_mode` | Allow [database user auto provisioning](../database-access/auto-user-provisioning.mdx) | Logical "OR" i.e. if any role allows database user auto-provisioning, it's allowed |
| `create_db_user_mode` | Allow [database user auto provisioning](../database-access/auto-user-provisioning.mdx) (`off`, `keep`, `best_effort_drop`) | Logical "OR" i.e. if any role allows database user auto-provisioning, it's allowed |
Copy link
Copy Markdown
Contributor

@ptgott ptgott Oct 24, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a way to describe each possible value here?

Copy link
Copy Markdown
Contributor Author

@gabrielcorado gabrielcorado Oct 24, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added the same description as the role spec.

@gabrielcorado gabrielcorado temporarily deployed to vercel October 24, 2023 20:18 — with GitHub Actions Inactive
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Oct 24, 2023

🤖 Vercel preview here: https://docs-edaxmcxks-goteleport.vercel.app/docs/ver/preview

@gabrielcorado gabrielcorado added this pull request to the merge queue Oct 24, 2023
Merged via the queue into master with commit 860623e Oct 24, 2023
@gabrielcorado gabrielcorado deleted the gabrielcorado/db-auto-provisioning-mode-docs branch October 24, 2023 20:51
@public-teleport-github-review-bot
Copy link
Copy Markdown

public-teleport-github-review-bot Bot commented Oct 24, 2023

@gabrielcorado See the table below for backport results.

Branch Result
branch/v14 Create PR

@gabrielcorado gabrielcorado mentioned this pull request Oct 24, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@greedy52 greedy52 greedy52 approved these changes

@ptgott ptgott ptgott approved these changes

@smallinsky smallinsky Awaiting requested review from smallinsky

@lsgunn-teleport lsgunn-teleport Awaiting requested review from lsgunn-teleport

@r0mant r0mant Awaiting requested review from r0mant

@xinding33 xinding33 Awaiting requested review from xinding33

@zmb3 zmb3 Awaiting requested review from zmb3

Assignees

@gabrielcorado gabrielcorado

Labels

documentation no-changelog Indicates that a PR does not require a changelog entry size/sm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@gabrielcorado @greedy52 @ptgott