Use Teleport CA

To configure the SingleStore database to trust the Teleport CA and issue a certificate for the database, perform the following tasks:

1. To use the tctl command-line tool, a Teleport user must be able to assume the Db system role. Add the following allow rule to the Teleport user's role:

   YAML

   Copy

   allow:
     impersonate:
       users: ["Db"]
       roles: ["Db"]

2. Run the following command to export Teleport's CA and generate a certificate/key pair. Update the hostname where the Teleport Database Service can access the SingleStore database server and the certificate validity period before running the command.

   Shell

   Copy

   tctl auth sign --format=db --host=<hostname> --out=server --ttl=<validity>

   This command creates 3 files:

   • server.cas

   • server.crt

   • server.key

3. Export the Teleport Database CA public certificate and merge it with server.cas to generate a bundled certificate to be used by the SingleStore database.

   Shell

   Copy

   tctl auth export --type=db > teleport-db-ca.pem
   cat server.cas teleport-db-ca.pem > teleport-bundle.pem

Enable TLS Connections

Run the following commands to enable TLS connections for SingleStore. Update the path to the respective file before running each command.

sdb-admin update-config --key ssl_cert --value /path/to/server.crt --all --yes
sdb-admin update-config --key ssl_key --value /path/to/server.key --all --yes
sdb-admin update-config --key ssl_ca --value /path/to/teleport-bundle.pem --all --yes
sdb-admin update-config --key ssl_ca_for_client_cert --value /path/to/teleport-bundle.pem --all --yes

# Restart the database to apply updates
sdb-admin restart-node --all --yes

Create/Update a Database User

Teleport uses a certificate to authenticate database users. Either create a new user or update an existing user to authenticate via a certificate. For example:

• To create a new SingleStore database user:

  SQL

  Copy

  CREATE USER 'jane'@'%' REQUIRE SUBJECT '/CN=jane';

  Provide the necessary privileges to the new database user. For example:

  SQL

  Copy

  GRANT ALL PRIVILEGES ON dbTest.* TO 'jane';

• Update an existing user:

  SQL

  Copy

  ALTER USER 'jane'@'%' REQUIRE SUBJECT '/CN=jane';
  
  -- Remove the password for the user
  SET PASSWORD FOR 'jane'@'%' = PASSWORD("");

Install on a Linux Server

1. To install a Teleport Agent on a Linux server, run the Teleport cluster's install script. The script selects the correct version, edition, and installation mode for the cluster. For example:

   Shell

   Copy

   curl "https://<Teleport_cluster_hostname>:<port>/scripts/install.sh" | sudo bash

   Update the Teleport cluster hostname and port before running the command.

2. Generate a configuration file at /etc/teleport.yaml for the Teleport Database Service. Update example.teleport.sh:443 in the command to use the host and port of the Teleport Proxy Service. Specify the endpoint (host:port) of the SingleStore deployment in the --uri option. For example:

   Note

   This command configures Teleport Database Service to use the Teleport CA.

   Also, a single Teleport process can run multiple services. The following command overwrites any existing configuration file. If you're running multiple services, add --output=stdout to print the configuration in the terminal, and then manually adjust /etc/teleport.yaml.

   Shell

   Copy

   sudo teleport db configure create \
      -o file \
      --token=/tmp/token \
      --proxy=example.teleport.sh:443 \
      --name=example-singlestore \
      --protocol=mysql \
      --uri=s2.example.com:3306 \
      --labels=env=dev

3. Configure the Teleport Database Service to automatically start when the system starts.

   • If Teleport is installed using a package manager, run the following commands:

     Shell

     Copy

     sudo systemctl enable teleport
     sudo systemctl start teleport

   • If Teleport is installed using a tar archive, run the following command:

     Shell

     Copy

     sudo teleport install systemd -o /etc/systemd/system/teleport.service
     sudo systemctl enable teleport
     sudo systemctl start teleport

   Run the systemctl status teleport command to view the status of the Teleport Database Service.

Install on a Kubernetes Cluster

Teleport provides Helm charts to install the Teleport Database Service on a Kubernetes cluster.

1. Configure Helm to fetch the Teleport charts from the Teleport Helm repository. Run the following command:

   Shell

   Copy

   helm repo add teleport https://charts.releases.teleport.dev

2. Run the following command to refresh the local Helm cache:

   Shell

   Copy

   helm repo update

3. Install a Teleport Agent in the Kubernetes cluster with the Teleport Database Service configuration. Create a values.yaml file with the required configuration.

   The following configures the Teleport Database Service to use the Teleport CA. Update the host and port of the Teleport Proxy Service and the endpoint of the SingleStore deployment. Replace JOIN_TOKEN with the Teleport Database Token created earlier.

   YAML

   Copy

   roles: db
   proxyAddr: example.teleport.sh
   # Set to false if using Teleport Community Edition
   enterprise: true
   authToken: "JOIN_TOKEN"
   databases:
     - name: example-mysql
       uri: s2.example.com:3306
       protocol: mysql
       static_labels:
         env: dev

4. Install the chart.

   Shell

   Copy

   helm install teleport-kube-agent teleport/teleport-kube-agent \
     --create-namespace \
     --namespace teleport-agent \
     --version 18.2.10 \
     -f values.yaml

5. Run the following command to verify that the Teleport Agent is running:

   Shell

   Copy

   kubectl -n teleport-agent get pods

   NAME                    READY   STATUS    RESTARTS   AGE
   teleport-kube-agent-0   1/1     Running   0          32s