AKS 자동 검색은 태그가 구성된 레이블과 일치하면 모든 AKS 클러스터를 자동으로 검색하고 Teleport에 등록할 수 있습니다.

작동 방식#

Teleport cluster auto-discovery involves two components:

1. The Teleport Discovery Service that watches for new clusters or changes to previously discovered clusters. It dynamically registers each discovered cluster as a kube_cluster resource in your Teleport cluster. It does not need connectivity to the clusters it discovers.
2. The Teleport Kubernetes Service that monitors the dynamic kube_cluster resources registered by the Discovery Service. It proxies communications between users and the cluster.

사전 요구 사항#

• A running Teleport cluster. If you want to get started with Teleport, sign up for a free trial or set up a demo environment.

• The tctl and tsh clients.

  Installing `tctl` and `tsh` clients

  1. Determine the version of your Teleport cluster. The tctl and tsh clients must be at most one major version behind your Teleport cluster version. Send a GET request to the Proxy Service at /v1/webapi/find and use a JSON query tool to obtain your cluster version. Replace with the web address of your Teleport Proxy Service:

     $ TELEPORT_DOMAIN=
     $ TELEPORT_VERSION="$(curl -s https://$TELEPORT_DOMAIN/v1/webapi/find | jq -r '.server_version')"
     

  2. Follow the instructions for your platform to install tctl and tsh clients:

• AD 그룹을 생성하고 연결할 권한이 있는 Azure 신원.
• 실행 중인 하나 이상의 AKS 클러스터.
• AKS 클러스터에 대한 접근.
• Teleport 검색 및 Kubernetes 서비스를 실행할 호스트.

1/2단계. 필요한 권한으로 Azure 신원 설정#

각 클러스터의 인증 및 인가 설정에 따라 Azure는 Teleport가 서버로 요청을 전달하는 데 필요한 권한을 구성하는 다른 방법을 사용합니다.

클러스터에서 사용되는 인증 모드를 확인하고 하나 이상의 권한 시나리오를 선택합니다. 일부 구성에서 Teleport는 필요한 권한이 포함된 경우 클러스터에 대한 접근을 자동으로 구성할 수 있습니다.

  {
      "Name": "AKS Teleport Discovery",
      "Description": "Required permissions for Teleport auto-discovery.",
      "Actions": [
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action"
      ],
      "NotActions": [],
      "DataActions": [
        "Microsoft.ContainerService/managedClusters/groups/impersonate/action",
        "Microsoft.ContainerService/managedClusters/users/impersonate/action",
        "Microsoft.ContainerService/managedClusters/serviceaccounts/impersonate/action",
        "Microsoft.ContainerService/managedClusters/pods/read",
        "Microsoft.ContainerService/managedClusters/authorization.k8s.io/selfsubjectaccessreviews/write",
        "Microsoft.ContainerService/managedClusters/authorization.k8s.io/selfsubjectrulesreviews/write",
      ],
      "NotDataActions": [],
      "assignableScopes": [
          "/subscriptions/{subscription_id}"
      ]
  }

```json
  {
      "Name": "AKS Teleport Discovery",
      "Description": "Required permissions for Teleport auto-discovery.",
      "Actions": [
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
        "Microsoft.ContainerService/managedClusters/runcommand/action",
        "Microsoft.ContainerService/managedclusters/commandResults/read"
      ],
      "NotActions": [],
      "DataActions": [],
      "NotDataActions": [],
      "assignableScopes": [
          "/subscriptions/{subscription_id}"
      ]
  }
```

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: teleport
rules:
- apiGroups:
  - ""
  resources:
  - users
  - groups
  - serviceaccounts
  verbs:
  - impersonate
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - get
- apiGroups:
  - "authorization.k8s.io"
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - create

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: teleport
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: teleport
subjects:
- kind: Group
  name: {azure_ad_group_id}
  apiGroup: rbac.authorization.k8s.io

  {
      "Name": "AKS Teleport Discovery",
      "Description": "Required permissions for Teleport auto-discovery.",
      "Actions": [
        "Microsoft.ContainerService/managedClusters/read",
        "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
      ],
      "NotActions": [],
      "DataActions": [],
      "NotDataActions": [],
      "assignableScopes": [
          "/subscriptions/{subscription_id}"
      ]
  }

2/2단계. AKS 클러스터를 검색하도록 Teleport 구성#

Teleport 설치#

Kubernetes 서비스와 검색 서비스를 실행하는 데 사용하는 호스트에 Teleport를 설치합니다:

To install a Teleport Agent on your Linux server:

The recommended installation method is the cluster install script. It will select the correct version, edition, and installation mode for your cluster.

1. Assign to your Teleport cluster hostname and port, but not the scheme (https://).

2. Run your cluster's install script:

   $ curl "https:///scripts/install.sh" | sudo bash
   

참여 토큰 가져오기#

Teleport AKS 자동 검색에는 검색 및 Kubernetes 서비스가 클러스터에 참여하기 위한 유효한 인증 토큰이 필요합니다. Teleport Auth Service에 대해 다음 명령을 실행하여 생성하고 Kubernetes 검색을 실행할 머신의 /tmp/token에 저장합니다:

$ tctl tokens add --type=discovery,kube --format=text
(=presets.tokens.first=)

Kubernetes 서비스 및 검색 서비스 구성#

Kubernetes 서비스와 검색 서비스를 실행하는 호스트에서 /etc/teleport.yaml에 다음 내용으로 Teleport 구성 파일을 생성합니다:

AKS 자동 검색을 활성화하려면 discovery_service.azure 섹션에 하나 이상의 항목이 포함되어야 하고 discovery_service.azure.types에 aks가 포함되어야 합니다. 또한 Kubernetes 서비스가 검색 서비스에서 생성된 동적 리소스를 수신하도록 discovery_service.azure.tags에 구성된 레이블과 동일하거나 하위 집합의 레이블을 사용하도록 kubernetes_service.resources.tags를 구성해야 합니다.

version: v3
teleport:
  join_params:
    token_name: "/tmp/token"
    method: token
  proxy_server: "teleport.example.com:443"
auth_service:
  enabled: false
proxy_service:
  enabled: false
ssh_service:
  enabled: false
discovery_service:
  enabled: true
  discovery_group: "aks-prod"
  azure:
  - types: ["aks"]
    regions: ["*"]
    subscriptions: ["*"]
    resource_groups: ["*"]
    tags:
      "env": "prod"
kubernetes_service:
  enabled: true
  resources:
  - labels:
      "env": "prod" # 앞서 지정한 Kubernetes 클러스터 레이블과 매칭

이 구성을 추가한 후 Teleport를 시작합니다. Azure 섹션에 지정된 태그와 리전과 일치하는 AKS 클러스터가 Teleport 클러스터에 자동으로 추가됩니다.

Configure the Kubernetes and Discovery Services to start automatically when the host boots up by creating a systemd service for it. The instructions depend on how you installed the Kubernetes and Discovery Services.

You can check the status of the Kubernetes and Discovery Services with systemctl status teleport and view its logs with journalctl -fu teleport.

문제 해결#

Discovery Service troubleshooting#

First, check if any Kubernetes clusters have been discovered. To do this, you can use the tctl get kube_cluster command and check if the expected Kubernetes clusters have already been registered with your Teleport cluster.

If some Kubernetes clusters do not appear in the list, check if the Discovery Service selector labels match the missing Kubernetes cluster tags or look into the Discovery Service logs for permission errors.

Check that the Discovery Service is running with credentials for the correct AWS account. It can discover resources in another AWS account, but it must be configured to assume a role in the other AWS account if that's the case.

Check if there is more than one Discovery Services running:

$ tctl inventory status --connected

If you are running multiple Discovery Services, you must ensure that each service is configured with the same discovery_group value if they are watching the same cloud Kubernetes clusters or a different value if they are watching different cloud Kubernetes clusters. If this is not configured correctly, a typical symptom is kube_cluster resources being intermittently deleted from your Teleport cluster's registry.

Kubernetes Service troubleshooting#

If the tctl get kube_cluster command returns the discovered clusters, but the tctl kube ls command does not include them, check that you have set the kubernetes_service.resources section correctly.

kubernetes_service:
  enabled: true
  resources:
  - labels:
      "env": "prod"

If the section is correctly configured, but clusters still do not appear or return authentication errors, please check if permissions have been correctly configured in your target cluster or that you have the correct permissions to list Kubernetes clusters in Teleport.