alexk

22 ms·

151.
by alexk 10y ago
We support OIDC connectors, so you can plug in LDAP using https://github.com/coreos/dex as one of the providers, or simply roll a new OIDC provider customized to your needs.
152.
by alexk 10y ago
This can be quite inconvenient, that's why there's a way to make it more user friendly by using 2FA authentication or Google based SSO with your SSH: http://gravitational.com/teleport/docs/admin-guide&#x2
153.
by alexk 10y ago
Certificates are better - you don't need to worry about distributing your public keys everywhere. Here's a nice article about setting up a CA for your OpenSSH servers: https://www.digitalocean.com/community/tu
154.
by alexk 10y ago
That's why short lived certs are better then just private keys - even if the key is stolen, the system can cut off the access by not issuing the renewed certificate. This makes private key itself to be irrelevant, in fact it can be gen
155.
by alexk 10y ago
I highly recommend to move off password-based SSH at all in favor of SSH keys or (even better, certificates). Here are some projects to help you roll out new infrastructure without SSH passwords: https://github.com/gravitati
156.
by alexk 10y ago
It's a bit of a failure on our (gravitational) side as we are moving fast and haven't submitted PR yet. We will definitely try to merge upstream soon though. We've added several features and changes to the code compared to Si
157.
by alexk 10y ago
Check this out: https://github.com/gravitational/stolon this is heavily modified version of https://github.com/sorintlab/stolon K8s-native deployment of PostgreSQL
158.
by alexk 10y ago
Someone also mentioned it as a possible tool to use during practical Devops interviews - e.g. "Set up this MySQL instance"
159.
by alexk 10y ago
I would simply recommend to use full solution https://www.gravitational.com/teleport if you want to have proper auth
160.
by alexk 10y ago
it does outbound SSH and HTTPS connections to teleconsole.com so if those are allowed, then the answer is yes
161.
by alexk 10y ago
Hey thanks for the tip :) Teleport lets me to join my customer's environments and provide live support in seconds - and they can see everything I do. That's the main reason we wrote it - to enable instant support for a distributed
162.
by alexk 11y ago
sure, you can execute commands via SSH on multiple nodes using labels as a selector. > tsh --proxy=work ssh os=linux df also, as mikeokner noticed, if you already using ansible, ansible-shell should work out of the box as well.
163.
by alexk 11y ago
we don't support sftp (yet), but we emulate SCP, so we can do the backup and upload for sure. We had this use-case in mind when building SCP feature set. Where would you like to push files (e.g. S3?)
164.
by alexk 11y ago
Hey, that's a good question and a valid concern. Teleport's auth server is designed to be extendable and we plan to add support for a variety of existing authentication and authorization protocols in the upcoming releases based on
165.
by alexk 11y ago
Hey, good catch - "fully compatible" was an overstatement, so we've updated the landing page!
166.
by alexk 11y ago
We'll work on the multiplexing demo, sure! Man pages are a good idea, we wrote a bunch of docs: http://gravitational.com/teleport/docs/quickstart/ but haven't packaged it all into man pages yet
167.
by alexk 11y ago
> 1) How does session archiving work with non-line-oriented applications? (e.g. top and its brethren) We capture and replay the whole stream, so playback works well with top/mc/emacs/vim etc > 2) Does it ever capture pa
168.
by alexk 11y ago
Thanks! I don't think teleport will work with mosh as mosh uses custom UDP-based protocol that we'd have to support, however if we'll get lots of feature requests for it, we'll definitely consider implementing it!
169.
by alexk 11y ago
hey, thanks! you can connect using standard ssh client http://gravitational.com/teleport/docs/admin-guide/#using-te... or use little tsh tool we wrote: http://gravitational.com/teleport/d
170.
by alexk 11y ago
Sure, Ansible works in it's OpenSSH client mode, check out https://gravitational.com/teleport/docs/admin-guide/#using-t... - Ansible section We are also thinking about deeper integration with state of th
171.
by alexk 11y ago
Thanks! One time provisioning token helps node to connect and get a host certificate signed by the right CA key. All further authentication happens using OpenSSH host certificates. This also means that new nodes can simply join the cluster
172.
by alexk 11y ago
Fully agree - K8s has tons lots of self-healing capabilities as long as it functions correctly. Our goal was to extend this with a lower layer that will detect failures that are mission critical for k8s deployments to run properly like etcd
173.
by alexk 11y ago
I agree - detecting failures in a distributed system is very hard, especially if you don't know what's the root cause right away. I also think it would be very helpful to have a set of standard platform health and diagnostic check
174.
by alexk 11y ago
Think of it as a system of low level K8s specific checks that is designed to be autonomous and does not need a third-party to run. Regardless of any node failures we can still get the diangostic information about cluster state (as long as t
175.
by alexk 11y ago
The best part with Gravitational is that you don't need to "migrate" to our platform. We port your application deployment to work with Google Kubernetes. As long as the app works on Kubernetes it works with us too on AWS, Goo
176.
Introducing the Kubernetes Kubelet in CoreOS Linux(coreos.com)
1 points by alexk 11y ago|0 comments
177.
by alexk 12y ago
Can you elaborate a bit more about the things that made them awesome and the things that they did not want to change?
178.
by alexk 12y ago
1. No if you don't call wait on child. Make sure to collect the status though in case if child has crashed for some reason otherwise you will end up with zombie: syscall.Wait4(-1, &wait, syscall.WNOHANG, nil) I would also re
179.
by alexk 12y ago
For us it's about not dropping your customers requests when we can, obviously that happens sometimes, but there's no need to do that if you can avoid it during normal deployment cycles.
180.
by alexk 12y ago
I ended up using different library: https://github.com/gwatts/manners But the code that extracts the fd without using reflection and access to the private properties is here: https://github.com/mailgun&

More ›