Upload the Teleport CA Bundle

Upload the exported Teleport CA bundle to SingleStore to enable client verification for MTLS/X509. Perform the following tasks:

1. Log in to the Cloud Portal and select your deployment.

2. On the Security tab, select Upload CA Bundle.

3. Upload the teleport-db-client.pem file exported earlier.

Upon successful upload, the CA Bundle uploaded message is displayed. Additionally, you can view, replace, or delete a CA bundle.

Create/Update a Database User

Teleport uses a certificate to authenticate database users. Either create a new user or update an existing user to authenticate via a certificate. For example:

• To create a new SingleStore database user:

  SQL

  Copy

  CREATE USER 'jane'@'%' REQUIRE SUBJECT '/CN=jane';

  Provide the necessary privileges to the new database user. For example:

  SQL

  Copy

  GRANT ALL PRIVILEGES ON dbTest.* TO 'jane';

• Update an existing user:

  SQL

  Copy

  ALTER USER 'jane'@'%' REQUIRE SUBJECT '/CN=jane';
  
  -- Remove the password for the user
  SET PASSWORD FOR 'jane'@'%' = PASSWORD("");

Install on a Linux Server

1. To install a Teleport Agent on a Linux server, run the Teleport cluster's install script. The script selects the correct version, edition, and installation mode for the cluster. For example:

   Shell

   Copy

   curl "https://<Teleport_cluster_hostname>:<port>/scripts/install.sh" | sudo bash

   Update the Teleport cluster hostname and port before running the command.

2. Generate a configuration file at /etc/teleport.yaml for the Teleport Database Service.

   1. Download the SingleStore CA from https://portal.singlestore.com/static/ca/singlestore_bundle.pem.

   2. Run the following command to generate the configuration file. Specify the SingleStore CA file in the --ca-cert-file option.

      Note

      A single Teleport process can run multiple services. The following command overwrites any existing configuration file. If you're running multiple services, add --output=stdout to print the configuration in the terminal, and then manually adjust /etc/teleport.yaml.

      Shell

      Copy

      sudo teleport db configure create \
         -o file \
         --token=/tmp/token \
         --proxy=example.teleport.sh:443 \
         --name=example-singlestore \
         --protocol=mysql \
         --uri=<singlestore_endpoint>:3306 \
         --ca-cert-file="/path/to/singlestore_bundle.pem" \
         --labels=env=dev

      where,

      • --proxy: Host and port of the Teleport Proxy Service.

      • --uri: Endpoint of the SingleStore deployment.

        Refer to SingleStore Helios Endpoints to determine the endpoint (host:port) of your deployment.

3. Configure the Teleport Database Service to automatically start when the system starts.

   • If Teleport is installed using a package manager, run the following commands:

     Shell

     Copy

     sudo systemctl enable teleport
     sudo systemctl start teleport

   • If Teleport is installed using a tar archive, run the following command:

     Shell

     Copy

     sudo teleport install systemd -o /etc/systemd/system/teleport.service
     sudo systemctl enable teleport
     sudo systemctl start teleport

   Run the systemctl status teleport command to view the status of the Teleport Database Service.