Support configuring kubernetes public_addr port in AWS AMI

[sklirg]

Expected behavior:

Being able to configure the port of the kubernetes.public_addr exposed by proxy_service.

Current behavior:

The port is hard-coded to 3026:

https://github.com/gravitational/teleport/blob/v12.3.2/assets/aws/files/bin/teleport-generate-config#L132-L147

This breaks when using multiplexing on the proxy_service, which listens on another port than 3026.

Bug details:

• Teleport version: v12.3.2
• Recreation steps:
  • Set up Teleport using AWS AMIs and Terraform
  • Configure Teleport to run in multiplex mode through PROXY_MULTIPLEXING in teleport-generate-configuration.
  • (Some?^1) Teleport clients are now instructed to connect to the Teleport proxy on port 3026 for Kubernetes requests, while the proxy expects the client to connect on port 443.
• Debug logs
  • No logs from Teleport clusters since the client doesn't actually connect to Teleport, but (some^1?) client(s) will get some error message based on how the connection attempt is treated, such as "dial tcp: :3026: connect: operation timed out".
  • We received this from tbot in a GitHub Actions which ran kubectl apply and received "Unable to connect to the server: dial tcp :3026: i/o timeout" in response.

^1: I tried to reproduce this locally by logging out and back in through tsh to get the "incorrect" public_addr, but my tsh client seemed to manage to connect correctly even though the kubernetes.public_addr was configured incorrectly. Maybe tbot and tsh are configured differently when multiplexing is configured, so that tsh "understands" that all "public_addr"s should point to the same port, but tbot doesn't? I didn't dig into this in detail because of the ongoing issue.

[sklirg]

I've worked around this myself with some systemd-magic and shell scripting, but I'll gladly contribute a more permanent fix as well.

Would it make sense to simply add a variable for specifying the port, or should it be set directly to the public_addr of the proxy service if multiplexing is enabled? Or can it be omitted completely, and then the client will use the public addr, which is the case for e.g. postgres? (not specifying a postgres_public_addr will make the client use public_addr instead, iirc.)

[Assylbek2002]

Problem is actual for me.

[tt0y]

Me too