dgkirkwood / teleport-terraform-quickstart

Teleport Quick Start with Terraform

Are you looking at getting started with Teleport? Are you familiar with HashiCorp Terraform? Then this repository is for you!

Whether you are testing Teleport for your home lab or work environment, or just want to learn something new, the purpose of this repository is to help you get started.

The repository is split into three major components:

1. Teleport Targets
   • IaC templates to create Teleport targets. This is the infrastructure that you will be accessing behind Teleport and includes SSH servers, Kubernetes clusters, databases and Windows Desktops.
2. Teleport Clusters
   • IaC templates to stand up the Teleport service itself.
3. Configuration (Coming soon)
   • IaC templates of Teleport configuration.

Please visit the subdirectories for each component for instructions on how to use the Terraform code within.

teleport-terraform-quickstart's Issues

variables.auto.pkvars.hcl isn't registered for variables.pkr.hcl

Using packer version 1.8.3 it doesn't seem to respect variables.auto and only takes defaults if they're in the varaibles.pkr.hcl file itself.

InvalidKeyPair.NotFound: The key pair 'dk-rsa' does not exist

Is it using the key we provide it? It seems like the key pair dk-rsa is hardcoded ...which is cool if your DK but I'm not :)

Move this to a private repo until we test it a bit more.

I think generally its fine as public but given that I think this could be really useful as an official release, we should move it to a private teleport repo so we can get more internal visibility to it as well.

The terraform tries to create the resource record set, but the instructions say to create the records ourselves?

Error building changeset: InvalidChangeBatch: [Tried to create resource record set [name='georgetest.teleportdemo.com.', type='A'] but it already exists]

Is the error I get, and this is right because of these instructions

"A domain name which can be used for the public address of your server. This code assumes you have an existing hosted zone on AWS, and DNS records are created using that hosted zone. This proxy also uses Lets Encrypt for certificates, which requires a public DNS address."

so I created those before hand, it doesn't seem like thats required though since it tries to create it for me?

Duplicate policies when running terraform apply

The terraform apply command tries to create IAM Policy proxy-ec2describe and IAM role proxy-ec2_assume. Even though they already exist. Either we should make the above names dynamic or have a check to see if those policies already exist and skip.

pasted the error below.

Error: error creating IAM Policy proxy-ec2decribe: EntityAlreadyExists: A policy called proxy-ec2decribe already exists. Duplicate names are not allowed.
│ status code: 409, request id: 0fe75764-6373-4999-b8cb-7ae7a56421bf
│
│ with aws_iam_policy.describeinstances,
│ on iam.tf line 1, in resource "aws_iam_policy" "describeinstances":
│ 1: resource "aws_iam_policy" "describeinstances" {
│
╵
╷
│ Error: failed creating IAM Role (proxy-ec2_assume): EntityAlreadyExists: Role with name proxy-ec2_assume already exists.
│ status code: 409, request id: 71680695-d96f-43ed-b674-5e3466fb1186
│
│ with aws_iam_role.ec2_assume,
│ on iam.tf line 26, in resource "aws_iam_role" "ec2_assume":
│ 26: resource "aws_iam_role" "ec2_assume" {