Skip to content

Commit 294611f

Browse files
mdsketchmdsketch
authored
Merge pull request #13 from seven-beep/develop
Apt installation method, version autodetection, more detailed configuration template
2 parents 65500c7 + 34e84ad commit 294611f

13 files changed

+331
-130
lines changed

‎LICENSE

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
The MIT License (MIT)
22

33
Copyright (c) 2021 KPM Power
4+
Copyright (c) 2024 seven-beep <ebn@entreparentheses.xyz>
45

56
Permission is hereby granted, free of charge, to any person obtaining a copy of
67
this software and associated documentation files (the "Software"), to deal in

‎README.md

Lines changed: 67 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
[![Ansible Lint](https://github.com/mdsketch/ansible-teleport/actions/workflows/lint.yml/badge.svg)](https://github.com/mdsketch/ansible-teleport/actions/workflows/lint.yml)
55
[![molecule_tests](https://github.com/mdsketch/ansible-teleport/actions/workflows/molecule.yml/badge.svg)](https://github.com/mdsketch/ansible-teleport/actions/workflows/molecule.yml)
66

7-
An ansible role to install or update the teleport node service and teleport config on Debian based systems.
7+
An ansible role to install or update the teleport node service and teleport config on Linux based systems.
88

99
Works with any architecture that teleport has a binary for, see available [teleport downloads](https://goteleport.com/teleport/download/).
1010

@@ -15,7 +15,6 @@ Please Check the teleport config file [documentation](https://goteleport.com/doc
1515
## TODO:
1616
- add idempotence tests to verify teleport is updated correctly (config, service and binary)
1717
- add tests for variable templating
18-
- lock down the versions of the linting tools
1918
- investigate if installing teleport in a docker container is useful (currently not supported)
2019

2120
## Requirements
@@ -24,16 +23,26 @@ A running teleport cluster so that you can provide the following information:
2423

2524
- auth token (dynamic or static). Ex: `tctl nodes add --ttl=5m --roles=node | grep "invite token:" | grep -Eo "[0-9a-z]{32}"`
2625
- CA pin
27-
- address of the authentication server
26+
- address of the authentication or proxy server
2827

2928
## Role Variables
3029

3130
These are the default variables with their default values as defined in `defaults/main.yml`
3231

32+
```
33+
teleport_nodename: ""
34+
```
35+
The nodename to apply in the configuration. Keep it as an empty string to let teleport use the hostname of the machine.
36+
37+
```
38+
teleport_autodetect_version: false
39+
```
40+
Whether or not try to autodetect the server version by querying its API.
41+
3342
```
3443
teleport_version
3544
```
36-
The version of teleport to install. See [teleport downloads](https://goteleport.com/teleport/download/) for available versions.
45+
The version of teleport to install. See [teleport downloads](https://goteleport.com/teleport/download/) for available versions. Keep it as an empty string if you want the role to autodetect the server version.
3746

3847
```
3948
teleport_architecture
@@ -45,6 +54,21 @@ Change `teleport_architecture` any of the following:
4554
- `amd64-bin` if you are running on x86_64/AMD64 based devices.
4655
- `386-bin` if you are running on i386/Intel based devices.
4756

57+
```
58+
teleport_install_method: "tar"
59+
```
60+
The method used for installation, currently supported by the role:
61+
- `tar` Download an archive.
62+
- `apt` Install gravitational keyring and the packages requested via apt.
63+
64+
```
65+
teleport_edition: "oss"
66+
```
67+
This is only used with teleport_install_method: "apt":
68+
- `oss` if you are using the community edition.
69+
- `enterprise` if you are using the self-hosted edition.
70+
- `cloud` if you are using the cloud edition.
71+
4872
```
4973
teleport_config_template
5074
```
@@ -53,24 +77,29 @@ The template to use for the teleport configuration file. The default is `templat
5377
There are many [options available](https://goteleport.com/docs/setup/reference/config/) and you can substitute in your own template and add any variables you want.
5478

5579
```
56-
teleport_service_template
80+
teleport_ssh_labels
5781
```
58-
The template to use for the teleport service file. The default is `templates/default_teleport.service.j2`. You can substitute in your own template and add any variables you want.
82+
A list of list of key and values to template into the default teleport_config_template. Examples are shown as defaults above.
83+
84+
```
85+
teleport_ssh_commands
86+
```
87+
A list of dictionaries to template into the default teleport_config_template. Examples are shown as defaults above.
5988

6089
```
6190
teleport_ca_pin
6291
```
6392
The CA pin to use for the teleport configuration. This is optional, but [recommended](https://goteleport.com/docs/setup/admin/adding-nodes/#untrusted-auth-servers).
6493

6594
```
66-
teleport_config_path
95+
teleport_auth_server
6796
```
68-
The path to the teleport configuration file. The default is `/etc/teleport.yaml`.
97+
The authentication server to use for the teleport configuration. Examples are shown as defaults above.
6998

7099
```
71-
teleport_auth_servers
100+
teleport_proxy_server
72101
```
73-
The list of authentication servers to use for the teleport configuration. Examples are shown as defaults above.
102+
The proxy server to user for the teleport configuration. Examples are shown as defaults above.
74103

75104
```
76105
backup_teleport_config
@@ -89,7 +118,9 @@ Default `yes`. Controls if this role modifies the teleport config file.
89118

90119
## Upgrading Teleport
91120

92-
When the role is run, it checks if the installed version matches the version specified in `teleport_version`. If different then it will download the latest version and install it.
121+
For `tar` installation method, when the role is run, it checks if the installed version matches the version specified in `teleport_version`. If different then it will download the latest version and install it.
122+
123+
For `apt` installation method, the role will update the packages from the repository.
93124

94125
When performing an upgrade, a backup of the current configuration file in `teleport_config_path` will be created and a new configuration file templated in its place. When doing this a `teleport_auth_token` and `teleport_ca_pin` do not need to be provided, as they are pulled from the existing configuration file, and then templated into the new configuration file.
95126

@@ -116,10 +147,22 @@ For example to install teleport on a node:
116147
teleport_ssh_labels:
117148
- k: "label_key"
118149
v: "label_value"
150+
teleport_ssh_commands:
151+
- name: hostname
152+
command: [hostname]
153+
period: 60m0s
154+
- name: uptime
155+
command: [uptime, -p]
156+
period: 5m0s
157+
- name: version
158+
command: [teleport, version]
159+
period: 60m0s
160+
- name: ip-address
161+
command: ["/bin/sh","-c", "hostname -I | awk '{print $1}'"]
162+
period: 60m0s
119163
teleport_auth_token: "super secret auth token"
120164
teleport_ca_pin: "not as secret ca pin"
121165
teleport_auth_server: "auth server"
122-
teleport_proxy_server: "proxy server"
123166
```
124167

125168
*Created Teleport Config to `/etc/teleport.yaml`*
@@ -131,7 +174,6 @@ teleport:
131174
auth_token: "super secret auth token"
132175
ca_pin: "not as secret ca pin"
133176
auth_server: auth server
134-
proxy_server: proxy server
135177
log:
136178
output: stderr
137179
severity: INFO
@@ -143,15 +185,18 @@ ssh_service:
143185
labels:
144186
label_key: label_value
145187
commands:
146-
- name: hostname
147-
command: [hostname]
148-
period: 60m0s
149-
- name: uptime
150-
command: [uptime, -p]
151-
period: 5m0s
152-
- name: version
153-
command: [teleport, version]
154-
period: 60m0s
188+
- name: hostname
189+
command: [hostname]
190+
period: 60m0s
191+
- name: uptime
192+
command: [uptime, -p]
193+
period: 5m0s
194+
- name: version
195+
command: [teleport, version]
196+
period: 60m0s
197+
- name: ip-address
198+
command: ["/bin/sh","-c", "hostname -I | awk '{print $1}'"]
199+
period: 60m0s
155200
proxy_service:
156201
enabled: "no"
157202
https_keypairs: []

‎defaults/main.yml

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,32 @@
11
---
2-
teleport_version: "12.1.1"
2+
teleport_nodename: ""
3+
teleport_autodetect_version: false
4+
teleport_version: "{{ '15.4.11' if not teleport_autodetect_version }}"
35
teleport_architecture: "amd64-bin"
4-
# teleport_architecture: "arm-bin"
6+
# apt is supported.
7+
teleport_install_method: "tar"
8+
# Only used when teleport_install_method is not 'tar'
9+
teleport_edition: "oss"
510
teleport_auth_token: ""
611
teleport_ca_pin: ""
7-
teleport_auth_server: "https://auth.example.com"
12+
teleport_auth_server: ""
813
teleport_url: "https://get.gravitational.com/teleport-v{{ teleport_version }}-linux-{{ teleport_architecture }}.tar.gz"
914
teleport_config_path: "/etc/teleport.yaml"
1015
backup_teleport_config: yes
1116
teleport_config_template: "default_teleport.yaml.j2"
1217
teleport_service_template: "default_teleport.service.j2"
1318
teleport_ssh_labels: []
14-
teleport_proxy_server: ''
19+
teleport_ssh_commands:
20+
- name: hostname
21+
command: [hostname]
22+
period: 60m0s
23+
- name: uptime
24+
command: [uptime, -p]
25+
period: 5m0s
26+
- name: version
27+
command: [teleport, version]
28+
period: 60m0s
29+
teleport_proxy_server: ""
1530
teleport_control_systemd: yes
1631
teleport_template_config: yes
1732
# Default dont change

‎files/teleport-archive-keyring.asc

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
-----BEGIN PGP PUBLIC KEY BLOCK-----
2+
3+
mQINBF+R3LYBEADOEO9i3Dm5rEAiXONchX3M54QzZX0yHArSpYQ5aJDdJRQbqzqT
4+
+e2os8NpSjVDZFNz5ul8xkZsnCLX7pgrAYqq+vsXL4bMWDP96S6PjfVIAyV4ylv0
5+
DBReMdkaAZb/IoPhkSTT+ayw4eGEtUz/k7mxMpQ9ob7qFtGs8aNVT/An5LfFR1Lx
6+
9WOlFPPIAJKcHVIyRD+4EoCSn1R1c61UHFIRatbAnwOLs3iz4/GU+w9wdbuWbDuk
7+
nGdG0Lmlzp42HHxeJJFQlOTed97+trktvAiuzA/0lbQHEcWvxfWAy5//cjORp+H3
8+
RGLp8fJ+fFRAyA4WP6O3wIC4gAAgsEn8WpVT8wZYlLMRf694SeawBtyUSlcsn9i1
9+
LuOh5akOY3iQtH01+rMBjOaMkCmpT2nQaUH+HS2iZBddBHdAMMQtj2UolMRbUSxH
10+
+GJczes1t9/WH3vbvh5ESMOy0fH14Tjo+9yQYa4EhFNNloAG10DYFLlCj47fWDdS
11+
o/++vhZsKaS7yLHDGOLPT+x15ComG2gupmRkbATvUddztlsfF+tD97laT9eaLB1W
12+
zxszqr8+LxP961wmbS2j+ZBbXyrPr1Fln/TdyFAhkIMJ+J5hZB+NcjRUwUoB7nOd
13+
+FbTxtnyJb2iaJNCJHJQVA85IYzUpXA3CDdgUHF810kVBcBPBtLhZC5ybQARAQAB
14+
tCtHcmF2aXRhdGlvbmFsLCBJbmMgPGluZm9AZ3Jhdml0YXRpb25hbC5jb20+iQJU
15+
BBMBCAA+FiEEDF6LpWWOMg0bAxF5yH7VOmKCxBEFAl+R3LYCGwMFCRLMAwAFCwkI
16+
BwIGFQoJCAsCBBYCAwECHgECF4AACgkQyH7VOmKCxBFfxxAAiXWJm86oZtVdAlp1
17+
pzpKeV0pwgrnt7Uk8fu5tYpdE/oVMnwcdsDDQucItGtHGfjmzs3Cr8/praekenf1
18+
9iHSz422OpIGzCI4VfXaFPVfzbV1w7cSOnceY6lPnKUMrRBKKJX5Nw/6LZS40gsQ
19+
BoeZxe0MXB4tBc4dY30f1MQ44amRYmtTA7wep+ymVRfkPnHNnIrsdYGldbfPsbPO
20+
PUX8ZnWZiuI0+NgX3oBOl6YY4JehBJj61Ukx1DPHHLhhundHumChYFn+LBIZxD3O
21+
B9uoRzUzwUIM0N9IUjpGvtkqtm7Vbs6/bDxI4Owgsa7vXpEXZ2qD0AIle7sD0Fjl
22+
F19o2mXmEeQp9Fl4OrkZCURCQvPq9UCh6Nu0a1+SnbG+qXyyvqszy2tkV4xmcF4w
23+
Gib0SVT8RR08NeJXkHtBscnecgUA1BTH8J8RnUeQXZhUn51bVJk4JaDnEXp8VEP2
24+
gNce+oUY2XQtLDVzHysGhexDrWk8ycl/zvwyxKv+kj5QhjXugHkOMnW53mdMe3N/
25+
gwsV+kJUm6NdtLtTAOkky/GfkIGTWNQPD2/42T+0cA9lTVxihh+wz9tgA1ZbtVOK
26+
P2DNA10rsCuzGPFn8d6Khymt0o66dgfEloy9Y14leoqUCMPU3ibLP6bYuow2AJUz
27+
KcvTgmfjP1/ghNXI7E2vgNi8wta5Ag0EX5HctgEQALx4btbP47LwrIqB4loog2sT
28+
pac7fdbA+YVeqP/9KoLw1ZB+5DeqNKmtUHSau9mRVh8a8g7slpGhH6hxlEHr7ek/
29+
mA/o91jB4RGo5mfyuWcJQKRyHS4pWciEM/gK+o6lEceTdUwvKI6OrJ4koPd3HZth
30+
mw+xPyAdGKY3oBmrXeZ6XkuDfME8doRmuwlw/tbmje63/2j97ebiFfQcyWLH32d8
31+
T+yEpAj+55Qxp6aJZaDOeAuzBtyAopxGRjGsxBUF/VSUwxYb0bmwWgPIhPC77oEk
32+
AEMPsIsI9LJ8fQY/sOzwhyNNt+b7rgto6AFskz7urezzCuuIwMeupmC78QWGw9jM
33+
zHFf3R6O1KQ0v8PBYYb6BHkjzho6hTcOZO9Zh+XO4k6uEwlu+Zc0AmyHmQeQ3I8Z
34+
tAb//LJk9X62yNPE/8wjtEUzXqyzlLpGjRFr6kQv+6nqs8JxyCnS34Q+au2IqOnn
35+
iFkHj/w79mtmzR4G43wo3x1nGjyz+vTpsurmJ+qFMO0bLcE/HV8aGxs0YeQsByOc
36+
SU8TK6v+Wkn58LT4cvjIO5G/2UM7kucXl56hqvguvnFTLNqewWtqgS7IRuykcYgK
37+
HrBYb/iVH+Fb+9Th9VX7bl0ZeoH7O8RbvxKGkd90+DPsurBeIQ7S4zM9w7WnAsAC
38+
Sgs8owYZpHpyrK8QFD4zABEBAAGJAjwEGAEIACYWIQQMXoulZY4yDRsDEXnIftU6
39+
YoLEEQUCX5HctgIbDAUJEswDAAAKCRDIftU6YoLEEURID/4oQhZZPindZJHiwQqm
40+
0a8H1ssgZAz6E8PejoN0gbsblbOrtkGDLU8gvzksvd/9luSLRgPw++m6ut87PeMv
41+
MKc4UIyRb5oSgh5WE0bW9191Gkfge9DRrIdtUDG8N+oTlIWYHTXC5zlwmfMobtQE
42+
kFUdPbedhytYx1wgbh8KP8sLXGPXut5VqDy/EgNzqERnI5kLeiDvMsLz0xjdHpGW
43+
ASfJMNX120GU8Mwqa6gWvP52BB20pU9bC1VQX1qiqD6V1GpxQJ2jACKke6boiqbL
44+
Bdb0UgmW4XYIp4ZjLC842e0qSyfd8rt3PzYrbK/NPuXAV7f+wAhPSC18v+1Ap5Kh
45+
KKHRLvyUVGxwaBVedOuuC/OqJwSSLa0cQKytFK+3OJAdTYoHtsh++ScgEL/wOCXs
46+
gM5xmlI6Pk/6Ev0Hz/kDY5F0w4/VvSEaS/7TSkmf5JvxdueVObf5ry5O+L4J7t7y
47+
JwdtPhXgHR0PHidnh/02SVn8XIzHdB9OZ2i6Wr12loFZGltWdmJVkQC/cj/HBr5I
48+
ZizQril+7cXDI/8Hyk04d19rmjSIU49FderpNYYOv38dqaAsosYge6JzYdIzJrJH
49+
/DIKnSAU/a14sFUrNm+TYJmZto35hSltUxLEzLIWeR9TjpOh6VS1UzdGQh32NP+h
50+
oq8y1SJMCrfC9Ub5q2/ijiJWUw==
51+
=+Ne5
52+
-----END PGP PUBLIC KEY BLOCK-----

‎tasks/auth_conf.yml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
- name: "Slurp the precedent configuration."
3+
become: yes
4+
ansible.builtin.slurp:
5+
src: "{{ teleport_config_path }}"
6+
register: old_conf_raw
7+
8+
- name: "Set the precedent configuration as a fact."
9+
ansible.builtin.set_fact:
10+
old_conf: "{{ old_conf_raw['content'] | b64decode | from_yaml }}"
11+
12+
- name: "Set fact teleport_auth_token from precedent configuration" # noqa no-handler
13+
ansible.builtin.set_fact:
14+
teleport_auth_token: "{{ old_conf.teleport.auth_token }}"
15+
when:
16+
- old_conf.teleport.auth_token is defined
17+
- old_conf.teleport.auth_token | string
18+
- not teleport_auth_token | string
19+
20+
- name: "Set fact teleport_ca_pin from precedent configuration"
21+
ansible.builtin.set_fact:
22+
teleport_ca_pin: "{{ old_conf.teleport.ca_pin }}"
23+
when:
24+
- old_conf.teleport.ca_pin is defined
25+
- old_conf.teleport.ca_pin | string
26+
- not teleport_ca_pin | string
27+
28+
- name: "Flush the teleport database when the token or ca_pin has changed."
29+
when: >-
30+
(
31+
old_conf.teleport.auth_token is defined and old_conf.teleport.auth_token | string
32+
and teleport_auth_token | string and teleport_auth_token != old_conf.teleport.auth_token
33+
) or (
34+
old_conf.teleport.ca_pin and old_conf.teleport.ca_pin | string
35+
and teleport_ca_pin | string and teleport_ca_pin != old_conf.teleport.ca_pin
36+
)
37+
notify: Reload_Teleport
38+
become: yes
39+
block:
40+
- name: "Stop teleport service if enabled"
41+
ansible.builtin.systemd:
42+
name: "teleport"
43+
state: "stopped"
44+
when:
45+
- not is_container
46+
47+
- name: "Delete teleport sqlite file"
48+
ansible.builtin.file:
49+
path: "/var/lib/teleport/proc/sqlite.db"
50+
state: absent

‎tasks/detect_cloud_version.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
- name: "Lookup the server version"
3+
ansible.builtin.uri:
4+
url: >-
5+
{{ "https://" +
6+
( teleport_proxy_server if teleport_proxy_server | string else teleport_auth_server )
7+
+ "/v1/webapi/automaticupgrades/channel/stable/cloud/version" }}
8+
return_content: true
9+
status_code: 200
10+
register: teleport_server_lookup
11+
12+
- name: "Set the server version as a fact"
13+
ansible.builtin.set_fact:
14+
teleport_version: "{{ teleport_server_lookup.content | regex_replace('^v', '') }}"

‎tasks/install_via_apt.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
- name: "Install via apt"
3+
become: true
4+
block:
5+
- name: "Set the teleport_major_version and teleport_pkgs facts"
6+
ansible.builtin.set_fact:
7+
teleport_major_version: "{{ 'v' + teleport_version | regex_replace('[.].*$', '') }}"
8+
teleport_pkgs: >-
9+
{% if teleport_edition == "oss" %}teleport{%
10+
elif teleport_edition == "enterprise" %}teleport-ent{%
11+
else %}teleport-ent=v{{ teleport_version }} teleport-ent-updater{% endif %}
12+
13+
- name: "Install the pgp keys of info@gravitational.com"
14+
ansible.builtin.copy:
15+
src: teleport-archive-keyring.asc
16+
dest: /usr/share/keyrings/teleport-archive-keyring.asc
17+
owner: root
18+
group: root
19+
mode: "0644"
20+
21+
- name: "Configure the teleport sources list"
22+
ansible.builtin.template:
23+
src: teleport.sources.j2
24+
dest: /etc/apt/sources.list.d/teleport.sources
25+
owner: "root"
26+
group: "root"
27+
mode: "0644"
28+
29+
- name: "Install teleport"
30+
ansible.builtin.apt:
31+
name: "{{ teleport_pkgs }}"
32+
state: latest # noqa: package-latest
33+
force_apt_get: true
34+
update_cache: true
35+
notify: Reload_Teleport

0 commit comments

Comments
 (0)