Deploy production teleport cluster

[tuladhar]

Current Status

Teleport test cluster deployed on AWS (root account: 084190472784) in Frankfurt:

• URL: https://test.teleport.giantswarm.io/
• Access: GitHub SSO

Deployment method

• Terraform - https://github.com/giantswarm/teleport-ha-autoscale-cluster/tree/test

Requirements

• Deploy teleport cluster for production use.
  • Domain: https://teleport.giantswarm.io
  • Access: GitHub SSO
• Ensure grafana is not publicly exposed.
• Ensure only Teleport proxy port (443) is exposed.

[kopiczko]

From my point of view this is mostly finished.

We have this repository: https://github.com/giantswarm/teleport-fleet/

It's managed with Github actions and updated with renovate.

It still requires some documentation updates.

The biggest question now for me is how to monitor this.

[kopiczko]

Things left to do:

• Fix access role in teleport clusters | slack thread | PR #36
• Deploy teleprot-operator to all installations (from collections)
• Create tokens for all installations
• Create bot users for all instalaltions
• mc-bootstrap dummy secret - https://github.com/giantswarm/mc-bootstrap/pull/702
• Add teleport bot token and bot user creation to mc-bootstrap #2998