gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
17.45k stars 1.75k forks source link

16.3 version seems to enforce layer 7 load balancer and ask users to use tsh proxy kube #47414

Open ealogar opened 2 days ago

ealogar commented 2 days ago

Expected behavior: After last upgrade when you run the command:

tsh kube login xxxx-cluster Logged into Kubernetes cluster "xxxx-cluster".

You were automatically logged and can run kubectl/k9s without any issues

Current behavior: Now this message appears:

Your Teleport cluster runs behind a layer 7 load balancer or reverse proxy.

To access the cluster, use "tsh kubectl" which is a fully featured "kubectl" command that works when the Teleport cluster is behind layer 7 load balancer or reverse proxy. To run the Kubernetes client, use: tsh kubectl version

Or, start a local proxy with "tsh proxy kube" and use the kubeconfig provided by the local proxy with your native Kubernetes clients: tsh proxy kube -p 8443

Learn more at https://goteleport.com/docs/architecture/tls-routing/#working-with-layer-7-load-balancers-or-reverse-proxies-preview

Running the proxy works but WE can not connect to more than two clusters without killing the tsh proxy.

I am running teleport from a macbook Pro M1 with ARM arch and this messages doesnt appear on Windows....

Bug details:

greedy52 commented 22 hours ago

@ealogar

I am running teleport from a macbook Pro M1 with ARM arch and this messages doesnt appear on Windows....

Do you know if your mac need to go through some reverse proxy to reach Teleport Proxy? like corporate proxy tools, cloudflare warp etc.

If you run tsh commands with this env var TELEPORT_TLS_ROUTING_CONN_UPGRADE=false, do things proceed successfully?

Also, tsh proxy kube do support multiple kube clusters. if you don't specify a kube cluster to the command, it will load all kube cluster clusters you already tsh kube login. For example, you can tsh kube login --all first, then tsh proxy kube -p 8433.