Teleport can provide secure access to Vitess (MySQL) via the Teleport Database Service. This allows for fine-grained access control through the Teleport RBAC system.

The Teleport Database Service proxies traffic from database clients to self-hosted databases in your infrastructure. Teleport maintains a certificate authority (CA) for database clients. You configure your database to trust the Teleport database client CA, and the Teleport Database Service presents certificates signed by this CA when proxying user traffic. With this setup, there is no need to store long-lived credentials for self-hosted databases.

Meanwhile, the Teleport Database Service verifies self-hosted databases by checking their TLS certificates against either the Teleport database CA or a custom CA used with the database.

In this guide, you will:

1. Configure your Vitess (MySQL) database for Teleport access.
2. Add the database to your Teleport cluster.
3. Connect to the database via Teleport.

동작 원리#

The Teleport Database Service authenticates to your self-hosted Vitess database using mutual TLS. Vitess trusts the Teleport certificate authority for database clients, and presents a certificate signed by either the Teleport database CA or a custom CA. When a user initiates a database session, the Teleport Database Service presents a certificate signed by Teleport. The authenticated connection then proxies client traffic from the user.

사전 요구사항#

• A running Teleport cluster. If you want to get started with Teleport, sign up for a free trial or set up a demo environment.

• The tctl and tsh clients.

  Installing `tctl` and `tsh` clients

  1. Determine the version of your Teleport cluster. The tctl and tsh clients must be at most one major version behind your Teleport cluster version. Send a GET request to the Proxy Service at /v1/webapi/find and use a JSON query tool to obtain your cluster version. Replace with the web address of your Teleport Proxy Service:

     $ TELEPORT_DOMAIN=
     $ TELEPORT_VERSION="$(curl -s https://$TELEPORT_DOMAIN/v1/webapi/find | jq -r '.server_version')"
     

  2. Follow the instructions for your platform to install tctl and tsh clients:

• 셀프 호스팅 Vitess 인스턴스.
• Teleport Database Service를 실행할 호스트(예: Amazon EC2 인스턴스).
• 선택 사항: 셀프 호스팅 데이터베이스에 인증서를 발급하는 인증 기관.

To check that you can connect to your Teleport cluster, sign in with tsh login, then verify that you can run tctl commands using your current credentials.

For example, run the following command, assigning to the domain name of the Teleport Proxy Service in your cluster and to your Teleport username:

$ tsh login --proxy= --user=
$ tctl status
# Cluster  (=teleport.url=)
# Version  (=teleport.version=)
# CA pin   (=presets.ca_pin=)

If you can connect to the cluster and run the tctl status command, you can use your current credentials to run subsequent tctl commands from your workstation. If you host your own Teleport cluster, you can also run tctl commands on the computer that hosts the Teleport Auth Service for full permissions.

1/4단계. Teleport Database 토큰 생성#

The Database Service requires a valid join token to join your Teleport cluster. Run the following tctl command and save the token output in /tmp/token on the server that will run the Database Service:

$ tctl tokens add --type=db --format=text
(=presets.tokens.first=)

2/4단계. 인증서/키 쌍 생성#

Teleport uses mutual TLS authentication with self-hosted databases. These databases must be able to verify certificates presented by the Teleport Database Service. Self-hosted databases also need a certificate/key pair that Teleport can verify.

By default, the Teleport Database Service trusts certificates issued by a certificate authority managed by the Teleport Auth Service. You can either:

• Configure your self-hosted database to trust this CA, and instruct Teleport to issue a certificate for the database to present to the Teleport Database Service.
• Configure the Database Service to trust a custom CA.

3/4단계. Vitess 구성#

---
apiVersion: v1
kind: Secret
metadata:
  name: example-cluster-config
type: Opaque
stringData:
  server.cas: |
    -----BEGIN CERTIFICATE-----
    MIIDlDCCAnygAwIBAgIQcCge3zdTWnA7isWitaG5yzANBgkqhkiG9w0BAQsFADBk
    ...
    jtOP8B0/0xc=
    -----END CERTIFICATE-----
  server.crt: |
    -----BEGIN CERTIFICATE-----
    MIIDqjCCApKgAwIBAgIRAKq0OQqYIx3pbkSVpIgMooowDQYJKoZIhvcNAQELBQAw
    ...
    aRWuAdb7KYfHgZgC+k5jiFS9MYPbOc3qMK6KwGAU
    -----END CERTIFICATE-----
  server.key: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIEpQIBAAKCAQEAsiejNWoNPPgcjjNZvG0pA+eADXxPyiGf6Or7oiy2ZmkblC4I
    ...
    hr6KW+m+bBx0ABXrJVZ4dfv7ppP173vhavmSG3dvo2D5savAay6L/bE=
    -----END RSA PRIVATE KEY-----

cells:
  - name: zone1
    gateway:
      extraFlags:
        mysql_auth_server_impl: clientcert
      secureTransport:
        required: true
        tls:
          clientCACertSecret:
            name: teleport-cluster-config
            key: server.cas
          certSecret:
            name: teleport-cluster-config
            key: server.crt
          keySecret:
            name: teleport-cluster-config
            key: server.key

vtgate ...                                      \
    --mysql_server_ssl_ca=/path/to/server.cas   \
    --mysql_server_ssl_cert=/path/to/server.crt \
    --mysql_server_ssl_key=/path/to/server.key  \
    --mysql_auth_server_impl=clientcert

Teleport 사용자 생성#

For more detailed information about database access controls and how to restrict access see RBAC documentation.

Database Service 구성 및 시작#

Teleport Database Service를 실행할 위치에 Teleport를 설치하고 구성합니다:

$ sudo teleport db configure create \
   -o file \
   --token=/tmp/token \
   --proxy=:443 \
   --name=example-vitess \
   --protocol=mysql \
   --uri=db.example.com:3306 \
   --labels=env=dev 

$ sudo teleport db configure create \
   -o file \
   --token=/tmp/token \
   --proxy=:443 \
   --name=example-vitess \
   --protocol=mysql \
   --uri=db.example.com:3306 \
   --trust-system-cert-pool \
   --labels=env=dev

$ helm repo add teleport (=teleport.helm_repo_url=)

$ helm repo update

roles: db
proxyAddr:  name="example.teleport.sh" />
# Set to false if using Teleport Community Edition
enterprise: true
authToken: "JOIN_TOKEN" />"
databases:
  - name: example-vitess
    uri: db.example.com:3306
    protocol: mysql
    static_labels:
      env: dev

(!docs/pages/includes/database-access/multiple-instances-tip.mdx !)

4/4단계. 연결#

Database Service가 클러스터에 참여하면 로그인하여 사용 가능한 데이터베이스를 확인합니다:

$ tsh login --proxy=teleport.example.com --user=alice
$ tsh db ls
# Name           Description    Labels
# -------------- -------------- --------
# example-vitess Example Vitess env=dev

$ tsh login --proxy=mytenant.teleport.sh --user=alice
$ tsh db ls
# Name           Description    Labels
# -------------- -------------- --------
# example-vitess Example Vitess env=dev

역할이 접근할 수 있는 데이터베이스만 볼 수 있습니다. 자세한 내용은 RBAC 가이드를 참조하십시오.

데이터베이스에 대한 자격 증명을 검색하고 연결하려면:

$ tsh db connect example-vitess

데이터베이스 인스턴스에 연결할 때 기본적으로 사용할 데이터베이스 이름과 사용자를 선택적으로 지정할 수 있습니다:

$ tsh db connect --db-user=root --db-name=mysql example-vitess

데이터베이스에서 로그아웃하고 자격 증명을 제거하려면:

# 특정 데이터베이스 인스턴스에 대한 자격 증명 제거.
$ tsh db logout example-vitess
# 모든 데이터베이스 인스턴스에 대한 자격 증명 제거.
$ tsh db logout