Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Machine ID: Database Tunnel service #39880

Merged
merged 13 commits into from Apr 3, 2024
Merged

Conversation

strideynet
Copy link
Contributor

@strideynet strideynet commented Mar 27, 2024

Part of #36291

Adds a service to tbot which opens an authenticated database access tunnel without needing to run a separate process as previously.

Benefits:

  • Supports rotating credentials
  • Supports listening on a non-loopback interface
  • Avoids needing a second process and systemd service
  • Avoids writing credentials to disk as was previously required

Example config:

version: v2
auth_server: "leaf.tele.ottr.sh:443"
onboarding:
  token: "redacted"
  join_method: "token"

storage:
  type: directory
  path: /Users/noah/code/gravitational/teleport-scratch/configs/tbot/storage

services:
- type: database-tunnel
  listen: tcp://127.0.0.1:25432
  service: postgres-docker
  database: postgres
  username: postgres

changelog: Adds the database-tunnel service to tbot which allows an authenticated database tunnel to be opened by tbot. This is an improvement over the original technique of using tbot proxy db.

lib/tbot/tbot.go Outdated Show resolved Hide resolved
@strideynet strideynet added this pull request to the merge queue Apr 3, 2024
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Apr 3, 2024
@strideynet strideynet added this pull request to the merge queue Apr 3, 2024
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Apr 3, 2024
@strideynet strideynet added this pull request to the merge queue Apr 3, 2024
Merged via the queue into master with commit 60da3a1 Apr 3, 2024
36 checks passed
@strideynet strideynet deleted the strideynet/tbot-db-tunnel branch April 3, 2024 09:16
@public-teleport-github-review-bot

@strideynet See the table below for backport results.

Branch Result
branch/v14 Failed
branch/v15 Create PR

strideynet added a commit that referenced this pull request Apr 3, 2024
* Add Database Tunnel service config

* Start putting together the alpnproxy

* Further flesh out database tunnel service

* Reorganize and tidy

* Rearrange to avoid state on struct

* Tidy up logging

* Cache proxypings better

* Spell Cancel the american way

* Remove unnecessary change to client credential output

* Add integration test for db access tunnel

* Fix mistakenley renamed trace

* Fix test panicking

* Remove unnecessary boolean field
github-merge-queue bot pushed a commit that referenced this pull request Apr 3, 2024
* Machine ID: Database Tunnel service (#39880)

* Add Database Tunnel service config

* Start putting together the alpnproxy

* Further flesh out database tunnel service

* Reorganize and tidy

* Rearrange to avoid state on struct

* Tidy up logging

* Cache proxypings better

* Spell Cancel the american way

* Remove unnecessary change to client credential output

* Add integration test for db access tunnel

* Fix mistakenley renamed trace

* Fix test panicking

* Remove unnecessary boolean field

* Fix test
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants