diff --git a/helm/teleport-kube-agent/Chart.yaml b/helm/teleport-kube-agent/Chart.yaml
index 3bcb3a0..e8687b2 100644
--- a/helm/teleport-kube-agent/Chart.yaml
+++ b/helm/teleport-kube-agent/Chart.yaml
@@ -1,17 +1,9 @@
apiVersion: v2
-name: teleport-kube-agent
-version: [[ .Version ]]
-appVersion: 16.1.7
+appVersion: 16.2.1
description: Teleport provides a secure SSH, Kubernetes, database and application
remote access solution that doesn't get in the way.
-icon: https://s.giantswarm.io/app-icons/teleport/1/light.png
-type: application
-sources:
-- https://github.com/gravitational/teleport
+icon: https://goteleport.com/static/teleport-symbol-bimi.svg
keywords:
- Teleport
-annotations:
- application.giantswarm.io/team: bigmac
-maintainers:
- - name: giantswarm/team-bigmac
- email: team-bigmac@giantswarm.io
+name: teleport-kube-agent
+version: 16.2.1
diff --git a/helm/teleport-kube-agent/ci/ci-values.yaml b/helm/teleport-kube-agent/ci/ci-values.yaml
deleted file mode 100644
index 2579ac1..0000000
--- a/helm/teleport-kube-agent/ci/ci-values.yaml
+++ /dev/null
@@ -1,4 +0,0 @@
-proxyAddr: "teleport.demo.gaws.gigantic.io:443"
-authToken: "test"
-kubeClusterName: "test"
-roles: "kube"
diff --git a/helm/teleport-kube-agent/templates/_helpers.tpl b/helm/teleport-kube-agent/templates/_helpers.tpl
index 2ef4c56..3e00e27 100644
--- a/helm/teleport-kube-agent/templates/_helpers.tpl
+++ b/helm/teleport-kube-agent/templates/_helpers.tpl
@@ -33,7 +33,7 @@ if serviceAccount is not defined or serviceAccount.name is empty, use .Release.N
{{- if .Values.teleportVersionOverride -}}
{{- .Values.teleportVersionOverride -}}
{{- else -}}
- {{- .Chart.AppVersion -}}
+ {{- .Chart.Version -}}
{{- end -}}
{{- end -}}
@@ -41,18 +41,10 @@ if serviceAccount is not defined or serviceAccount.name is empty, use .Release.N
{{- if .Values.enterprise -}}
{{- .Values.enterpriseImage -}}
{{- else -}}
- {{- .Values.image.repository -}}
+ {{- .Values.image -}}
{{- end -}}
{{- end -}}
{{- define "teleport-kube-agent.image" -}}
{{ include "teleport-kube-agent.baseImage" . }}:{{ include "teleport-kube-agent.version" . }}
{{- end -}}
-
-{{- define "registry" }}
-{{- $registry := .Values.image.registry -}}
-{{- if and .Values.global (and .Values.global.image .Values.global.image.registry) -}}
-{{- $registry = .Values.global.image.registry -}}
-{{- end -}}
-{{- printf "%s" $registry -}}
-{{- end -}}
diff --git a/helm/teleport-kube-agent/templates/delete_hook.yaml b/helm/teleport-kube-agent/templates/delete_hook.yaml
index c6056b0..3690ae7 100644
--- a/helm/teleport-kube-agent/templates/delete_hook.yaml
+++ b/helm/teleport-kube-agent/templates/delete_hook.yaml
@@ -100,7 +100,7 @@ spec:
fieldPath: metadata.namespace
- name: RELEASE_NAME
value: {{ .Release.Name }}
- image: '{{ include "registry" . }}/{{ .Values.image.repository }}:{{ include "teleport-kube-agent.version" . }}'
+ image: {{ include "teleport-kube-agent.image" . | quote }}
{{- if .Values.imagePullPolicy }}
imagePullPolicy: {{ toYaml .Values.imagePullPolicy }}
{{- end }}
diff --git a/helm/teleport-kube-agent/templates/deployment.yaml b/helm/teleport-kube-agent/templates/deployment.yaml
index 97b020d..4eb3f5d 100644
--- a/helm/teleport-kube-agent/templates/deployment.yaml
+++ b/helm/teleport-kube-agent/templates/deployment.yaml
@@ -126,7 +126,7 @@ spec:
{{- end }}
containers:
- name: "teleport"
- image: '{{ include "registry" . }}/{{ .Values.image.repository }}:{{ include "teleport-kube-agent.version" . }}'
+ image: {{ include "teleport-kube-agent.image" . | quote }}
{{- if .Values.imagePullPolicy }}
imagePullPolicy: {{ toYaml .Values.imagePullPolicy }}
{{- end }}
diff --git a/helm/teleport-kube-agent/templates/psp.yaml b/helm/teleport-kube-agent/templates/psp.yaml
index aa3578c..bdf8b10 100644
--- a/helm/teleport-kube-agent/templates/psp.yaml
+++ b/helm/teleport-kube-agent/templates/psp.yaml
@@ -2,7 +2,7 @@
We must remove them before 1.25 to ensure the Helm state doesn't corrupt. As this is a breaking change, this
only applies to v12+ charts. v11 and below will only show a warning from the NOTES.txt.
Users must use PSAs instead (beta in 1.23, GA in 1.25). The "teleport-cluster" chart runs in "baseline" mode */}}
-{{- if and (not .Values.global.podSecurityStandards.enforced) .Values.podSecurityPolicy.enabled (semverCompare "<1.25.0" .Capabilities.KubeVersion.Version) -}}
+{{- if and .Values.podSecurityPolicy.enabled (semverCompare "<1.23.0-0" .Capabilities.KubeVersion.Version) -}}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
diff --git a/helm/teleport-kube-agent/templates/statefulset.yaml b/helm/teleport-kube-agent/templates/statefulset.yaml
index 7d96392..030fc77 100644
--- a/helm/teleport-kube-agent/templates/statefulset.yaml
+++ b/helm/teleport-kube-agent/templates/statefulset.yaml
@@ -126,7 +126,7 @@ spec:
{{- end }}
containers:
- name: "teleport"
- image: '{{ include "registry" . }}/{{ .Values.image.repository }}:{{ include "teleport-kube-agent.version" . }}'
+ image: {{ include "teleport-kube-agent.image" . | quote }}
{{- if .Values.imagePullPolicy }}
imagePullPolicy: {{ toYaml .Values.imagePullPolicy }}
{{- end }}
@@ -151,6 +151,10 @@ spec:
- name: TELEPORT_EXT_UPGRADER_VERSION
value: {{ include "teleport-kube-agent.version" . }}
{{- end }}
+ {{- if .Values.clusterDomain }}
+ - name: TELEPORT_KUBE_CLUSTER_DOMAIN
+ value: {{ .Values.clusterDomain | quote }}
+ {{- end }}
{{- if .Values.tls.existingCASecretName }}
- name: SSL_CERT_FILE
value: /etc/teleport-tls-ca/ca.pem
diff --git a/helm/teleport-kube-agent/values.schema.json b/helm/teleport-kube-agent/values.schema.json
index 993a9e2..e189523 100644
--- a/helm/teleport-kube-agent/values.schema.json
+++ b/helm/teleport-kube-agent/values.schema.json
@@ -2,7 +2,6 @@
"$schema": "http://json-schema.org/draft-07/schema",
"type": "object",
"required": [
- "global",
"proxyAddr",
"roles",
"joinParams",
@@ -38,34 +37,9 @@
"initContainers",
"resources",
"tolerations",
- "probeTimeoutSeconds",
- "proxy",
- "cluster"
+ "probeTimeoutSeconds"
],
"properties": {
- "global": {
- "$id": "#/properties/global",
- "type": "object",
- "required": [
- "podSecurityStandards"
- ],
- "properties": {
- "podSecurityStandards": {
- "$id": "#/properties/global/properties/podSecurityStandards",
- "type": "object",
- "required": [
- "enforced"
- ],
- "properties": {
- "enforced": {
- "$id": "#/properties/global/properties/podSecurityStandards/properties/enforced",
- "type": "boolean",
- "default": false
- }
- }
- }
- }
- },
"authToken": {
"$id": "#/properties/authToken",
"type": "string",
@@ -368,19 +342,8 @@
},
"image": {
"$id": "#/properties/image",
- "type": "object",
- "properties": {
- "registry": {
- "$id": "#/properties/image/registry",
- "type": "string",
- "default": "public.ecr.aws"
- },
- "repository": {
- "$id": "#/properties/image/repository",
- "type": "string",
- "default": "gravitational/teleport-distroless"
- }
- }
+ "type": "string",
+ "default": "public.ecr.aws/gravitational/teleport-distroless"
},
"enterpriseImage": {
"$id": "#/properties/enterpriseImage",
@@ -395,7 +358,7 @@
"replicaCount": {
"$id": "#/properties/replicaCount",
"type": "integer",
- "default": 2
+ "default": 1
},
"clusterRoleName": {
"$id": "#/properties/clusterRoleName",
@@ -437,7 +400,7 @@
"enabled": {
"$id": "#/properties/highAvailability/properties/podDisruptionBudget/properties/enabled",
"type": "boolean",
- "default": true
+ "default": false
},
"minAvailable": {
"$id": "#/properties/highAvailability/properties/podDisruptionBudget/properties/minAvailable",
@@ -814,41 +777,6 @@
"$id": "#/properties/jamfSecret",
"type": "string",
"default": ""
- },
- "proxy": {
- "$id": "#/properties/proxy",
- "type": "object",
- "properties": {
- "http": {
- "type": ["null", "string"]
- },
- "https": {
- "type": ["null", "string"]
- },
- "noProxy": {
- "type": ["null", "string"]
- }
- }
- },
- "cluster": {
- "$id": "#/properties/cluster",
- "type": "object",
- "properties": {
- "proxy": {
- "type": "object",
- "properties": {
- "http": {
- "type": ["null", "string"]
- },
- "https": {
- "type": ["null", "string"]
- },
- "noProxy": {
- "type": ["null", "string"]
- }
- }
- }
- }
}
}
}
diff --git a/helm/teleport-kube-agent/values.yaml b/helm/teleport-kube-agent/values.yaml
index 35bd198..0af79df 100644
--- a/helm/teleport-kube-agent/values.yaml
+++ b/helm/teleport-kube-agent/values.yaml
@@ -1,12 +1,7 @@
################################################################
# Values that must always be provided by the user.
################################################################
-global:
- podSecurityStandards:
- enforced: false
- image:
- registry: ""
# roles(string) -- is a comma-separated list of services which will be enabled
# when running the `teleport-kube-agent` chart.
#
@@ -71,7 +66,7 @@ joinParams:
# joinParams.method(string) -- controls which join method will be used by the
# instance to join the Teleport cluster.
#
- # See [the join method reference](../../join-methods.mdx) for the list of possible
+ # See [the join method reference](../../reference/join-methods.mdx) for the list of possible
# values, the implications of each join method, and guides to set up each method.
#
# Common join-methods for the `teleport-kube-agent` are:
@@ -85,7 +80,7 @@ joinParams:
# joinParams.tokenName(string) -- controls which token is used by the agent to
# join the Teleport cluster.
#
- # When `joinParams.method` is [a delegated join method](../../join-methods.mdx#delegated-join-methods),
+ # When `joinParams.method` is [a delegated join method](../../reference/join-methods.mdx#delegated-join-methods),
# the value is not sensitive.
#
# When `joinParams.method` is `token` (by default), `joinParams.tokenName`
@@ -114,7 +109,7 @@ kubeClusterName: ""
################################################################
# apps(list) -- is a static list of applications that should be proxied by
-# the agent. See [the Teleport Application access documentation](../../../enroll-resources/application-access/introduction.mdx)
+# the agent. See [the Teleport Application access documentation](../../reference/agent-services/application-access.mdx#configuration)
# for more details.
#
# Proxied applications can be defined statically (through this value) or dynamically
@@ -139,13 +134,13 @@ kubeClusterName: ""
#
# You can see a list of all the supported values that can be used in a Teleport
# Application Service configuration in the [Application Service Configuration
-# Reference](../../../enroll-resources/application-access/reference.mdx#configuration).
+# Reference](../../reference/agent-services/application-access.mdx#configuration).
#
apps: []
# appResources(list) -- is a set of labels the agent will monitor. Any application
# matching those labels will be proxied by the agent. See [the Teleport
-# Application access documentation](../../../enroll-resources/application-access/introduction.mdx)
+# Application access documentation](../../enroll-resources/application-access/introduction.mdx)
# for more details.
#
# Proxied applications can be defined statically (through [`apps`](#apps)) or
@@ -164,7 +159,7 @@ apps: []
#
#
# Once `appResources` is set, you can dynamically register application with
-# `tsh` by following [the Dynamic App Registration guide](../../../enroll-resources/application-access/guides/dynamic-registration.mdx).
+# `tsh` by following [the Dynamic App Registration guide](../../enroll-resources/application-access/guides/dynamic-registration.mdx).
#
appResources: []
@@ -184,7 +179,7 @@ clusterDomain: "cluster.local"
# awsDatabases(list) -- configures AWS database auto-discovery.
#
#
-# For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../../enroll-resources/database-access/enroll-aws-databases/rds.mdx#step-36-create-iam-policies-for-teleport).
+# For AWS database auto-discovery to work, your Database Service pods will need to use a role which has appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enroll-aws-databases/rds.mdx#step-36-create-iam-policies-for-teleport).
# After configuring a role, you can use an `eks.amazonaws.com/role-arn` annotation with the `annotations.serviceAccount` value to associate it with the service account and grant permissions:
#
# ```yaml
@@ -224,7 +219,7 @@ awsDatabases: []
# azureDatabases(list) -- configures Azure database auto-discovery.
#
-# For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../../enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx#step-35-configure-iam-permissions-for-teleport).
+# For Azure database auto-discovery to work, your Database Service pods will need to have appropriate IAM permissions as per the [database documentation](../../enroll-resources/database-access/enroll-azure-databases/azure-postgres-mysql.mdx#step-35-configure-iam-permissions-for-teleport).
#
# After configuring a service principal with appropriate IAM permissions, you must pass credentials to the pods.
# The easiest way is to use an Azure client secret.
@@ -296,7 +291,7 @@ awsDatabases: []
azureDatabases: []
# databases(list) -- is a static list of databases that should be proxied by
-# the agent. See [the Teleport Database access documentation](../../../enroll-resources/database-access/database-access.mdx)
+# the agent. See [the Teleport Database access documentation](../../enroll-resources/database-access/database-access.mdx)
# for more details.
#
# Proxied applications can be defined statically (through this value) or dynamically
@@ -325,7 +320,7 @@ azureDatabases: []
# ```
#
#
-# You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../../enroll-resources/database-access/reference/configuration.mdx).
+# You can see a list of all the supported [values which can be used in a Teleport database service configuration here](../../reference/agent-services/database-access-reference/configuration.mdx).
#
#
#
@@ -360,7 +355,7 @@ databases: []
# databaseResources(list) -- is a set of labels the agent will monitor.
# Any database matching those labels will be proxied by the agent. See [the Teleport
# Database access
-# documentation](../../../enroll-resources/database-access/database-access.mdx)
+# documentation](../../enroll-resources/database-access/database-access.mdx)
# for more details.
#
# Proxied databases can be defined statically (through [`databases`](#databases)) or
@@ -380,7 +375,7 @@ databases: []
#
#
# Once `databaseResources` is set, you can dynamically register database with
-# `tsh` by following [this guide](../../../enroll-resources/database-access/guides/dynamic-registration.mdx).
+# `tsh` by following [this guide](../../enroll-resources/database-access/guides/dynamic-registration.mdx).
#
databaseResources: []
@@ -394,7 +389,7 @@ databaseResources: []
# The Discovery Service is enabled when the agent `roles` contains "discovery".
# The Discovery service automatically detects Kubernetes Services and configures
# the agent to provide access to them. See [the Kubernetes App Discovery
-# documentation](../../../enroll-resources/auto-discovery/kubernetes-applications/architecture.mdx)
+# documentation](../../reference/architecture/kubernetes-applications-architecture.mdx)
# for more details.
#
#
@@ -520,7 +515,7 @@ caPin: []
# Using a self-signed TLS certificate and disabling TLS verification is OK for testing, but is not viable when running a production Teleport
# cluster as it will drastically reduce security. You must configure valid TLS certificates on your Teleport cluster for production workloads.
#
-# One option might be to use Teleport's built-in [ACME support](../teleport-cluster.mdx#acme) or enable [cert-manager support](../teleport-cluster.mdx#highavailabilitycertmanager).
+# One option might be to use Teleport's built-in [ACME support](../../reference/helm-reference/teleport-cluster.mdx#acme) or enable [cert-manager support](../../reference/helm-reference/teleport-cluster.mdx#highavailabilitycertmanager).
#
insecureSkipProxyTLSVerify: false
@@ -528,7 +523,7 @@ insecureSkipProxyTLSVerify: false
# Teleport pods. The configuration will be merged with the chart-generated
# configuration and will take precedence in case of conflict.
#
-# See the [Teleport Configuration Reference](../../config.mdx) for the list of supported fields.
+# See the [Teleport Configuration Reference](../../reference/config.mdx) for the list of supported fields.
#
# ```yaml
# teleportConfig:
@@ -709,7 +704,7 @@ podSecurityPolicy:
# and replaced since 1.23 by PodSecurityAdmission (PSA). If you are running on
# Kubernetes 1.23 or later, it is recommended to disable PSPs and use PSAs.
# The steps are documented in the
- # [PSP removal guide](../../../deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
+ # [PSP removal guide](../../admin-guides/deploy-a-cluster/helm-deployments/migration-kubernetes-1-25-psp.mdx).
#
# This value will be removed in a future chart version.
enabled: true
@@ -730,7 +725,7 @@ podSecurityPolicy:
# To set labels for applications, add a `labels` element to the [`apps`](#apps) section.
# To set labels for databases, add a `static_labels` element to the [`databases`](#databases) section.
#
-# For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../../management/admin/labels.mdx).
+# For more information on how to set static/dynamic labels for Teleport services, see [labelling nodes and applications](../../admin-guides/management/admin/labels.mdx).
#
#
# For example:
@@ -771,7 +766,7 @@ highAvailability:
# (via [`authToken`](#authToken), [`joinParams`](#joinParams), or [`joinTokenSecret`](#joinTokenSecret))
# is still valid. Each replica has its own identity and needs to join the Teleport
# cluster on its first startup.
- replicaCount: 3
+ replicaCount: 1
# highAvailability.requireAntiAffinity(bool) -- configures Kubernetes `requiredDuringSchedulingIgnoredDuringExecution`
# to require that multiple Teleport pods must not be scheduled on the same physical host.
@@ -796,7 +791,7 @@ highAvailability:
podDisruptionBudget:
# highAvailability.podDisruptionBudget.enabled(bool) -- makes the chart create
# a Kubernetes PodDisruptionBudget for the agent pods.
- enabled: true
+ enabled: false
# highAvailability.podDisruptionBudget.minAvailable(int) -- is the minimum
# available pod specified on the PodDisruptionBudget.
@@ -893,9 +888,8 @@ adminClusterRoleBinding:
# This setting only takes effect when [`enterprise`](#enterprise) is `false`.
# When running an enterprise version, you must use
# [`enterpriseImage`](#enterpriseImage) instead.
-image:
- registry: ®istry gsoci.azurecr.io
- repository: giantswarm/teleport-distroless
+image: public.ecr.aws/gravitational/teleport-distroless
+
# enterpriseImage(string) -- sets the container image used for Teleport Enterprise
# agent pods created by the chart.
#
@@ -1059,7 +1053,7 @@ log:
format: text
# log.extraFields(list) -- sets the fields used in logging for the Teleport process.
#
- # See the [Teleport config file reference](../../config.mdx) for
+ # See the [Teleport config file reference](../../reference/config.mdx) for
# more details on possible values for `extra_fields`.
extraFields: ["timestamp", "level", "component", "caller"]
@@ -1070,22 +1064,7 @@ log:
# affinity(object) -- sets the affinities for any pods created by the chart.
# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity)
# for more details.
-affinity:
- podAntiAffinity:
- preferredDuringSchedulingIgnoredDuringExecution:
- - weight: 100
- podAffinityTerm:
- labelSelector:
- matchLabels:
- app: teleport-kube-agent
- topologyKey: "kubernetes.io/hostname"
- nodeAffinity:
- preferredDuringSchedulingIgnoredDuringExecution:
- - preference:
- matchExpressions:
- - key: node-role.kubernetes.io/control-plane
- operator: Exists
- weight: 10
+affinity: {}
# dnsConfig(object) -- contains custom Pod DNS Configuration for the agent pods.
# This value is useful if you need to reduce the DNS load: set "ndots" to 0 and
@@ -1319,8 +1298,6 @@ securityContext:
# To unset the security context, set it to `null` or `~`.
podSecurityContext:
fsGroup: 9807
- seccompProfile:
- type: RuntimeDefault
# priorityClassName(string) -- sets the priority class used by any pods created by the chart.
# The user is responsible for creating the `PriorityClass` resource before deploying the chart.
@@ -1328,26 +1305,11 @@ podSecurityContext:
# for more details.
priorityClassName: ""
-tolerations:
- - effect: NoSchedule
- key: node-role.kubernetes.io/control-plane
- - effect: NoSchedule
- key: node.cluster.x-k8s.io/uninitialized
- operator: "Exists"
+# tolerations(list) -- sets the tolerations for any pods created by the chart.
+# See [the Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/)
+# for more details.
+tolerations: []
# probeTimeoutSeconds(int) -- sets the timeout for the readiness and liveness probes
# https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/
probeTimeoutSeconds: 1
-
-# set the HTTP_PROXY, HTTPS_PROXY and NO_PROXY variable
-proxy:
- noProxy:
- http:
- https:
-cluster:
- # is getting overwritten by the top level proxy if set
- # These values are generated via cluster-apps-operator
- proxy:
- noProxy:
- http:
- https:
diff --git a/vendir.lock.yml b/vendir.lock.yml
index f2f421c..d016227 100644
--- a/vendir.lock.yml
+++ b/vendir.lock.yml
@@ -2,8 +2,8 @@ apiVersion: vendir.k14s.io/v1alpha1
directories:
- contents:
- helmChart:
- appVersion: 16.1.7
- version: 16.1.7
+ appVersion: 16.2.1
+ version: 16.2.1
path: teleport-kube-agent
path: helm
kind: LockConfig
diff --git a/vendir.yml b/vendir.yml
index f28769e..144a309 100644
--- a/vendir.yml
+++ b/vendir.yml
@@ -6,7 +6,7 @@ directories:
- path: teleport-kube-agent
helmChart:
name: "teleport-kube-agent"
- version: "16.1.7"
+ version: "16.2.1"
repository:
url: https://charts.releases.teleport.dev
newRootPath: .