[EPIC] new VPN / Access Solution with Teleport

[gawertm]

Tasks

Beta Give feedback

1. https://github.com/giantswarm/giantswarm/issues/25895
2. https://github.com/giantswarm/giantswarm/issues/25399
3. Teleport Preparation for PoC #2193
   5 of 5
   team/bigmac +1
   
4. Teleport PoC #2494
   5 of 5
   team/bigmac topic/architecture topic/capi +3
   
5. Test CAPV installation with Teleport #2700
   4 of 4
   team/bigmac +1
   
6. Extend capi-image-builder to bake teleport binary #2699
   3 of 3
   team/bigmac +1
   
7. Test first CAPA private installation with Teleport #2786
   5 of 5
   provider/cluster-api-aws team/bigmac +2
   
8. Test first CAPZ installation with Teleport #2697
   4 of 4
   provider/cluster-api-azure team/bigmac +2
   
9. Test first CAPVCD installation with Teleport #2712
   provider/capvcd team/bigmac +2
   
10. Deploy production teleport cluster #2698
    team/bigmac +1
    
11. Teleport Migration #2689
    team/bigmac +1
    
12. Add teleport-operator to mc-bootstrap #2845
    component/mc-bootstrap team/bigmac +2
    
13. CAPA Teleport for SSH & cluster access #2733
    5 of 5
    area/kaas kind/epic provider/cluster-api-aws team/bigmac topic/capi +5
    
14. opensource teleport operator #2779
    team/bigmac +1
    
15. Teleport monitoring #2991
    team/bigmac +1
    
16. opsctl ssh should print instructions to use tsh ssh for CAPI instalaltions #2995
    team/bigmac +1
    
17. Teleport in Public Doc #3014
    component/vpn team/bigmac topic/documentation +3
    
18. Install teleport-kube-agent-app on CAPA MCs #3004
    3 of 3
    component/vpn team/bigmac +2
    
19. Extend Teleport to OAuth2 apps (Grafana, Happa, Prometheus, etc.) #3035
    2 of 6
    needs/refinement team/bigmac +2
    
20. CAPZ Teleport for SSH & cluster access #3036
    8 of 8
    area/kaas kind/epic provider/cluster-api-azure team/bigmac topic/capi +5
    
21. Teleport Monitoring extension #3094
    team/bigmac +1
    
22. Teleport for EKS cluster access #3156
    team/bigmac +1
    
23. Remove bastion hosts from CAPZ #3175
    +0
24. Teleport during MC creation, replace need for VPN #3201
    team/bigmac team/shield +2
    
25. https://github.com/giantswarm/giantswarm/issues/29709

[gawertm]

need another meeting with @alex-dabija to clarify the final architecture, location of Installation, etc.

[gawertm]

how to generate token to access central teleport instance, when customer creates a cluster and needs to inject that to the nodes.
token per installation. potentially run a controller on the MCs that would generate the tokens every e.g. 3 months and revoke the old one

[gawertm]

one concern that got raised during customer talks: where will audit logs be stored, in case we setup a "dedicated" leaf server for a customer? what kind of storage backends are supported? also where does that leaf server live? in our AWs account? what about Azure customers?