Module teleport 

Labels and annotations that let the teleport-kube-agent already deployed in every cluster discover the environmentd Service and register it as a Teleport app, via Kubernetes annotation-based auto-discovery.

This is Phase 1 of moving environmentd Teleport registration off of environment-controller’s tctl-based flow. It registers the app only; the db stays on environment-controller until Phase 2 installs the Teleport Kubernetes Operator.

Structs

Rewrite 🔒

RewriteHeader 🔒

TeleportConfig

The settings that the --teleport-* flags provide.

Constants

TELEPORT_APP_DESCRIPTION 🔒

TELEPORT_APP_PORT 🔒

The named environmentd Service port to register.

TELEPORT_APP_PROTOCOL 🔒

The internal HTTP endpoint is plain HTTP, not HTTPS. Set explicitly rather than relying on Teleport’s port-name heuristic to guess it.

TELEPORT_REWRITE_HEADER_NAME 🔒

Forces the support database user on internal HTTP requests reaching the registered app. This is a security control, not a convenience: it is what stops a support session from picking a different database role.

TELEPORT_REWRITE_HEADER_VALUE 🔒

Functions

apply_teleport_registration 🔒

Adds the Teleport discovery labels and annotations to service when --enable-teleport-registration is set. A no-op otherwise, which is the rollback path: without the flag, this function changes nothing about the Service.

dns1035_label_error 🔒

Why name is not a valid DNS-1035 label, or None when it is one.

ordinal 🔒

The trailing ordinal of a Materialize resource name, named environment-{org_uuid}-{ordinal}.

teleport_app_name 🔒

The Teleport app resource name: mz-{cloud_provider}-{region}-{base32(org_uuid)}-{ordinal}.