### Terraform Provider Setup Steps

Source: https://github.com/gravitational/teleport/blob/master/rfd/0173-terraform-machine-id.md

A simplified 3-step guide for setting up the Terraform provider, including logging in with `tsh`, evaluating `tctl terraform env`, and creating the `main.tf` file. This improves the getting started experience for new users.

```bash
run `tsh login`, `eval $(tctl terraform env)` and create the `main.tf`.
```

--------------------------------

### Evaluated Installer Script Example

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/includes/server-access/custom-installer-reference.mdx

Demonstrates the evaluated content of the installer script after templating variables are replaced. This shows the actual commands that would be executed during installation.

```sh
echo teleport.example.com
echo Teleport-(=teleport.version=)
echo Repository Channel: stable/v(=teleport.version=)
```

--------------------------------

### AWS CLI Installation Examples

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/installation/self-hosted/deployments/aws-starter-cluster-terraform.mdx

Instructions for installing the AWS CLI on different operating systems. It is recommended to use package managers when available.

```bash
Fedora/CentOS: `yum -y install awscli`
```

```bash
Ubuntu/Debian: `apt-get -y install awscli`
```

```bash
macOS (with [Homebrew](https://brew.sh/)): `brew install awscli`
```

--------------------------------

### Start Teleport Service (Package Manager)

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/enroll-resources/auto-discovery/kubernetes/gke-discovery.mdx

Use this command to start the Teleport service if installed via a package manager on Google Cloud.

```bash
$ sudo systemctl start teleport
```

--------------------------------

### Installer Resource with Templating Options

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/includes/server-access/custom-installer-reference.mdx

Example of an `installer` resource utilizing various templating variables for script generation. These variables are dynamically replaced during installation.

```yaml
kind: installer
metadata:
  name: default-installer
spec:
  script: |
    echo {{ .PublicProxyAddr }}
    echo Teleport-{{ .MajorVersion }}
    echo Repository Channel: {{ .RepoChannel }}
version: v1
```

--------------------------------

### Install and Start Teleport Service

Source: https://github.com/gravitational/teleport/blob/master/examples/systemd/README.md

Commands to copy the Teleport systemd service file, reload systemd, enable, and start the service.

```bash
sudo cp teleport.service /etc/systemd/system/teleport.service
sudo systemctl daemon-reload
sudo systemctl enable teleport
sudo systemctl start teleport
```

--------------------------------

### Install Teleport Service with launchd

Source: https://github.com/gravitational/teleport/blob/master/examples/launchd/README.md

Copy the Teleport launchd plist file to the system daemons directory and then load it to start the service.

```bash
sudo cp com.goteleport.teleport.plist /Library/LaunchDaemons/
sudo launchctl load /Library/LaunchDaemons/com.goteleport.teleport.plist
```

--------------------------------

### Complete Terraform Provider Configuration Example

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/configuration/terraform-provider/terraform-cloud.mdx

A minimal `provider.tf` example demonstrating the full Terraform configuration, including `terraform` block, `required_providers`, and the Teleport provider setup with necessary parameters.

```hcl
terraform {
  cloud {
    organization = "ExampleOrganization"

    workspaces {
      name = "example-workspace"
    }
  }

  required_providers {
    teleport = {
      source  = "terraform.releases.teleport.dev/gravitational/teleport"
      version = "(=teleport.plugin.version=)"
    }
  }
}

provider "teleport" {
  addr = "example.teleport.sh:443"
  join_method = "terraform_cloud"
  join_token = "terraform"
  audience_tag = "teleport"
}

resource "teleport_role" "test" {
  version = "v7"
  metadata = {
    name        = "test"
    description = "Dummy role to validate Terraform Provider setup"
    labels = {
      test = "yes"
    }
  }
}
```

--------------------------------

### Configure and Start Teleport (TAR Archive)

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/enroll-resources/auto-discovery/kubernetes/gke-discovery.mdx

Steps to create a systemd service, enable, and start Teleport when installed via a TAR archive on Google Cloud.

```bash
$ sudo teleport install systemd -o /etc/systemd/system/teleport.service
$ sudo systemctl enable teleport
$ sudo systemctl start teleport
```

--------------------------------

### Start fastmcp Server

Source: https://github.com/gravitational/teleport/blob/master/examples/mcp-servers/verify-teleport-jwt-fastmcp/README.md

Export the Teleport proxy URL and run the Python application to start the MCP server. Ensure you have the necessary dependencies installed via `uv sync`.

```bash
# export TELEPORT_PROXY_URL=https://teleport.example.com
$ uv sync
$ uv run main.py
```

--------------------------------

### Client Tools Configuration File Example

Source: https://github.com/gravitational/teleport/blob/master/rfd/0144-client-tools-updates.md

This JSON object represents the configuration file for client tools, detailing known proxy versions and a list of installed tool packages.

```json
{
  "configs": {
    "proxy.example.com": {
      "version": "17.5.1",
      "disabled": false
    }
  },
  "max_tools": 3,
  "tools": [
    {
      "version": "17.5.1",
      "path": {"tctl": "tctl", "tsh": "tsh"},
      "package": "d00ffd3d-700d-47b0-bd65-94506f1362e2-update-pkg-v2"
    },
    {
      "version": "17.5.2",
      "path": {"tctl": "tctl", "tsh": "tsh"},
      "package": "7de24a1e-8141-4fc8-9a1f-cd4665afa338-update-pkg-v2"
    }
  ]
}

```

--------------------------------

### Initialize Go Module and Install Teleport API Client

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/zero-trust-access/api/getting-started.mdx

Set up a new Go module for your project and install the Teleport API client library. This prepares your project for API interaction.

```bash
$ mkdir client-demo && cd client-demo
$ go mod init client-demo
$ go get github.com/gravitational/teleport/api/client
```

--------------------------------

### Agentless Teleport Discovery Configuration

Source: https://github.com/gravitational/teleport/blob/master/rfd/0057-automatic-aws-server-discovery.md

Example Teleport discovery configuration enabling agentless installation. This setup updates the OpenSSH CA to use the Teleport CA without installing the full Teleport Agent.

```yaml
discovery_service:
  enabled: "yes"
  aws:
  - types: ["ec2"]
    regions: ["us-west-1"]
    tags:
      "teleport": "yes" # aws tags to match
    install:
      install_teleport: true # default value
      # default to this as a result of agentless: true
      script_name: "default-agentless-installer"
      sshd_config: "/etc/ssh/sshd_config" # default path
    ssm:
      # default to this as a result of agentless: true
      document_name: "TeleportAgentlessDiscoveryInstaller"
```

--------------------------------

### Basic GitHub Actions Workflow Example

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/machine-workload-identity/deployment/github-actions.mdx

A basic GitHub Actions workflow file (`.github/workflows/example.yaml`) to help you get started with Teleport integration.

```yaml
# This is a basic workflow to help you get started.

```

--------------------------------

### Enable and Start tbot Service

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/includes/machine-id/daemon.mdx

Use this command to enable the tbot service to start on boot and start it immediately. This is typically used after tbot has been installed via the Teleport install script.

```bash
$ sudo systemctl enable tbot --now
```

--------------------------------

### Basic Usage of teleport_dynamic_windows_desktop

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/reference/infrastructure-as-code/terraform-provider/resources/dynamic_windows_desktop.mdx

This example demonstrates how to configure the teleport_dynamic_windows_desktop resource with essential metadata and spec details, including host address, non-AD status, domain, and screen size.

```hcl
resource "teleport_dynamic_windows_desktop" "example" {
  version = "v1"
  metadata = {
    name        = "example"
    description = "Test Windows desktop"
    labels = {
      "teleport.dev/origin" = "dynamic" // This label is added on Teleport side by default
    }
  }

  spec = {
    addr   = "some.host.com"
    non_ad = true
    domain = "my.domain"
    screen_size = {
      width  = 800
      height = 600
    }
  }
}
```

--------------------------------

### Automate Windows Auth Setup Installation

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/enroll-resources/desktop-access/getting-started.mdx

Use this command to automate the installation of the Teleport Windows Auth setup program from an administrative Command Prompt or PowerShell console. This command installs the program, specifies the certificate to use, and enables silent installation.

```powershell
$ teleport-windows-auth-setup-v(=teleport.version=)-amd64.exe install --cert=teleport.cer -r
```

--------------------------------

### Download and Install Event Handler for Linux

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/includes/plugins/install-event-handler.mdx

Download the pre-compiled binary for Linux, extract it, and run the install script. Replace ARCH with your system architecture (e.g., amd64, arm64).

```bash
$ curl -L -O https://cdn.teleport.dev/teleport-event-handler-v(=teleport.version=)-linux-<Var name="ARCH" />-bin.tar.gz
$ tar -zxvf teleport-event-handler-v(=teleport.version=)-linux-<Var name="ARCH" />-bin.tar.gz
$ sudo ./teleport-event-handler/install
```

--------------------------------

### Create a test file

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/machine-workload-identity/workload-identity/aws-oidc-federation.mdx

Create a sample file named `hello.txt` to upload to an S3 bucket for testing.

```bash
$ echo "Hello, World!" > hello.txt
```

--------------------------------

### tctl Example for Getting DiscoveryConfig

Source: https://github.com/gravitational/teleport/blob/master/rfd/0125-dynamic-auto-discovery-config.md

Demonstrates how to retrieve a DiscoveryConfig resource using the `tctl get` command.

```yaml
kind: DiscoveryConfig
version: v1
metadata:
  name: production-resources
spec:
    discovery_group: my-ec2
    aws:
     - types: ["ec2"]
       regions: ["us-east-1","us-west-1"]
       tags:
         "*":
```

```yaml
"*"
```

--------------------------------

### Example roles configuration

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/includes/helm-reference/zz_generated.teleport-kube-agent.mdx

Configure the comma-separated list of services to be enabled for the `teleport-kube-agent` chart.

```yaml
roles: kube,app,discovery
```

--------------------------------

### Start Teleport Discord Plugin (Executable)

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/identity-governance/access-requests/plugins/discord.mdx

Use this command to start the Teleport Discord plugin when installed as an executable. Ensure the plugin is configured correctly before starting.

```bash
$ teleport-discord start
```

```bash
INFO   Starting Teleport Access Discord Plugin (=teleport.version=): discord/app.go:80
INFO   Plugin is ready discord/app.go:101
```

--------------------------------

### Spawn and configure services dynamically

Source: https://github.com/gravitational/teleport/blob/master/rfd/0240-tbot-dynamic-services.md

Demonstrates spawning services and then fetching their configuration to be used later. Ensure services are started in the background before spawning others.

```bash
$ tbot start bot-api ... &
$ tbot api spawn identity ...
$ tbot api spawn app-tunnel ...
$ tbot api spawn ssh-multiplexer ...
$ tbot api config > tbot.yaml

# ...later, after stopping the first tbot process...
$ tbot start -c tbot.yaml # resumes with the previous config
```

--------------------------------

### Install teleport-ent-updater for Managed Updates

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/upgrading/agent-managed-updates-v1.mdx

Install the `teleport-ent-updater` package on each agent to enroll it into Managed Updates. This example shows installation for both cloud-hosted and self-hosted Teleport Enterprise.

```bash
$ curl (=teleport.teleport_install_script_url=) | bash -s ${TELEPORT_VERSION?} cloud
```

```bash
$ apt-get install -y teleport-ent-updater
```

--------------------------------

### Install and Call Stored Procedure with pgx

Source: https://github.com/gravitational/teleport/blob/master/rfd/0113-automatic-database-users.md

This Go code demonstrates how to connect to a PostgreSQL database using the `pgx` library, install a stored procedure, and then call it with parameters to create a user. It highlights the use of prepared statements for invoking stored procedures.

```go
// Connect to the database.
conn, _ := pgx.ConnectConfig(ctx, config)

// Install the procedure.
_, _ = conn.Exec(ctx, "create or replace procedure ...")

// Call the procedure to create the user.
_, _ = conn.Exec(ctx, "call teleport_create_user($1, $2)", username, []string{roleA, roleB})
```

--------------------------------

### Install Entra ID Plugin with Manual Setup

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/identity-governance/integrations/entra-id/setup/terraform.mdx

Install the Entra ID plugin for Teleport with manual setup. This command configures the plugin with a specified name, auth connector, default owner, and skips the access graph integration.

```bash
$ tctl plugins install entraid \
    --name entra-id-default \
    --auth-connector-name entra-id \
    --default-owner=<Var name="Access List Owner"/> \
    --no-access-graph \
    --manual-setup
```

--------------------------------

### Start tbot with a Configuration File

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/reference/machine-workload-identity/configuration.mdx

Use the `-c` flag to specify the path to your tbot configuration file when starting the tool.

```bash
$ tbot start -c ./tbot.yaml
```

--------------------------------

### Install GitHub Integration

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/reference/cli/tctl.mdx

Installs an Access Graph GitHub integration. Optionally specify a start date for audit log ingestion.

```bash
$ tctl plugins install github [<flags>]
```

--------------------------------

### App Session Start Audit Event Example

Source: https://github.com/gravitational/teleport/blob/master/rfd/0008-application-access.md

Example of an 'app.session.start' audit event, issued when a certificate is created for an application session.

```json
{
  "ei": 0,
  "event": "app.session.start",
  "uid": "a0065d17-d820-431d-9cc6-1933ab5abe39",
  "code": "T2007I",
  "time": "2020-11-19T22:20:46.257Z",
  "user": "rjones",
  "sid": "804defb1-e2fa-4daa-9ba1-b73490888c78",
  "namespace": "default",
  "server_id": "15a54155-aae2-410e-825f-6d0588fb0771",
  "addr.remote": "127.0.0.1:37380",
  "public_addr": "cli-app.proxy.example.com"
}
```

--------------------------------

### Open a browser with auth set up for manual testing

Source: https://github.com/gravitational/teleport/blob/master/e2e/README.md

Launches a browser instance with authentication pre-configured, allowing for manual interaction and testing of the Teleport Web UI.

```bash
./e2e/run.sh --browse
```

--------------------------------

### PSQL CLI Rendering Example

Source: https://github.com/gravitational/teleport/blob/master/rfd/0171-database-session-playback.md

Demonstrates the output of psql commands, including connection details, INSERT, SELECT, and exit.

```bash
$ psql
psql (16.2 (Homebrew))
SSL connection GCM_SHA256, (protocol: TLSv1.3, cipher: TLS_AES_128_ compression: off)
Type "help" for help.

my-database=# INSERT INTO events (name) VALUES ('end');
INSERT 0 1

my-database=# SELECT * FROM events;
id | name
---+-------
 1 | start 
 2 | end 
(2 rows)

my-database=# exit
```

--------------------------------

### Enable and Start Teleport Agent Service

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/upgrading/agent-managed-updates/agent-managed-updates.mdx

After Teleport is installed and `/etc/teleport.yaml` is configured, use this command to enable and start the Teleport Agent service.

```bash
$ sudo systemctl enable teleport --now
```

--------------------------------

### Open Connect with auth set up for manual testing

Source: https://github.com/gravitational/teleport/blob/master/e2e/README.md

Starts Teleport Connect with authentication already set up, facilitating manual testing and exploration of its features.

```bash
./e2e/run.sh --browse-connect
```

--------------------------------

### Initialize Echo Server and Logger

Source: https://github.com/gravitational/teleport/blob/master/rfd/0119-aws-api-integration-using-oidc.md

Sets up an Echo web server with debug mode enabled and a custom logger format.

```go
e := echo.New()
e.Debug = true
e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{
    Format: "method=${method}, uri=${uri}, status=${status}\n",
}))
```

--------------------------------

### Start PostgreSQL Container

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/enroll-resources/application-access/protect-apps/tcp.mdx

Use this command to start a PostgreSQL server in a Docker container for testing purposes. Ensure Docker is installed and running.

```bash
$ docker run --name postgres -p 5432:5432 -e POSTGRES_PASSWORD=<pass> -d postgres
```

--------------------------------

### Download Teleport Windows Auth Setup Program

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/enroll-resources/desktop-access/getting-started.mdx

Download the Teleport Windows Auth setup executable. Replace (=teleport.version=) with the specific Teleport version.

```bash
$ curl.exe -fo teleport-windows-auth-setup-v(=teleport.version=)-amd64.exe https://cdn.teleport.dev/teleport-windows-auth-setup-v(=teleport.version=)-amd64.exe
```

--------------------------------

### Dynamic GCP Installer Configuration

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/includes/server-access/custom-installer-gcp-config.mdx

Use this YAML configuration to specify a custom installer script within the Discovery Config for dynamic setup.

```yaml
version: "2"
kind: "discovery.services.teleport.dev"
metadata:
  name: "gcp-installer-discovery"
spec:
  resources:
    - id: "gce_instance"
      type: "gce_instance"
      discovery_groups:
        - "default"
      # Specify your custom installer script name here
      install:
        script_name: "my-custom-installer-script.sh"
```

--------------------------------

### SQL: Analyze UI Setup and Post-Setup Conversion Rates by Month

Source: https://github.com/gravitational/teleport/blob/master/rfd/0247-discover-iac-metrics.md

Calculates monthly conversion rates for both UI setup drop-off (before config) and post-setup success (after config). Requires the 'cluster_funnel' table.

```sql
WITH funnel AS (
  SELECT
    date_trunc('month', entered_at) AS month,
    count(*) AS entered_funnel,
    sum(reached_start) AS reached_start,
    sum(reached_copy) AS reached_copy,
    sum(reached_config) AS reached_config,
    sum(reached_verify) AS reached_verify,
    sum(reached_resources) AS reached_resources,
    sum(reached_no_issues) AS reached_no_issues
  FROM cluster_funnel
  GROUP BY 1
)
SELECT
  month,
  -- Before config: UI setup drop-off (% of entered_funnel)
  entered_funnel,
  ROUND(CAST(reached_start AS double) / NULLIF(entered_funnel, 0) * 100, 1) AS pct_started,
  ROUND(CAST(reached_copy AS double) / NULLIF(entered_funnel, 0) * 100, 1) AS pct_copied,
  ROUND(CAST(reached_config AS double) / NULLIF(entered_funnel, 0) * 100, 1) AS pct_configured,
  -- After config: post-setup success (% of reached_config)
  reached_config,
  ROUND(CAST(reached_verify AS double) / NULLIF(reached_config, 0) * 100, 1) AS pct_verified,
  ROUND(CAST(reached_resources AS double) / NULLIF(reached_config, 0) * 100, 1) AS pct_resources,
  ROUND(CAST(reached_no_issues AS double) / NULLIF(reached_config, 0) * 100, 1) AS pct_no_issues
FROM funnel
ORDER BY month DESC
```

--------------------------------

### Start Tbot with Configuration File

Source: https://github.com/gravitational/teleport/blob/master/rfd/0064-bot-for-cert-renewals.md

Start the tbot agent using a YAML configuration file to manage multiple certificate destinations and role assignments.

```bash
$ tbot -c /etc/tbot.yaml start
```

--------------------------------

### User Invitation URL Example

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/zero-trust-access/rbac-get-started/users.mdx

This is an example of the auto-expiring token URL generated after creating a user, which is used to complete user setup and set a password.

```text
User "joe" has been created but requires a password. Share this URL with the user to complete user setup, link is valid for 1h:
https://<proxy_host>:443/web/invite/<token>

NOTE: Make sure <proxy_host>:443 points at a Teleport proxy which users can access.
```

--------------------------------

### Auth Service Client Interface Example

Source: https://github.com/gravitational/teleport/blob/master/rfd/0065-distributed-tracing.md

Illustrates the `ClientI` interface for the Auth service, highlighting functions that do and do not accept `context.Context` as the first parameter, which is crucial for tracing context propagation.

```go
ClientI is a client to Auth service
type ClientI interface {
	// NewKeepAliver returns a new instance of keep aliver
	NewKeepAliver(ctx context.Context) (types.KeepAliver, error)

	// RotateCertAuthority starts or restarts certificate authority rotation process.
	RotateCertAuthority(req RotateRequest) error

	// RotateExternalCertAuthority rotates external certificate authority,
	// this method is used to update only public keys and certificates of the
	// the certificate authorities of trusted clusters.
	RotateExternalCertAuthority(ca types.CertAuthority) error

	// ValidateTrustedCluster validates trusted cluster token with
	// main cluster, in case if validation is successful, main cluster
	// adds remote cluster
	ValidateTrustedCluster(context.Context, *ValidateTrustedClusterRequest) (*ValidateTrustedClusterResponse, error)

	// GetDomainName returns auth server cluster name
	GetDomainName() (string, error)

	// GetClusterCACert returns the PEM-encoded TLS certs for the local cluster.
	// If the cluster has multiple TLS certs, they will all be concatenated.
	GetClusterCACert() (*LocalCAResponse, error)
}
```

--------------------------------

### Start Teleport Jira Plugin Executable

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/identity-governance/access-requests/plugins/jira.mdx

Command to start the Teleport Jira plugin when installed as an executable on a Linux host. It shows the initial startup logs.

```bash
$ sudo teleport-jira start
INFO   Starting Teleport Jira Plugin 12.1.1: jira/app.go:112
INFO   Plugin is ready jira/app.go:142
```

--------------------------------

### Passwordless Registration Example

Source: https://github.com/gravitational/teleport/blob/master/rfd/0088-passwordless-windows.md

Example of how a user would initiate MFA device addition, specifying 'webauthn' for Windows Hello or FIDO support. The system then prompts for device-specific interactions.

```shell
$tsh mfa add
> Choose device type [TOTP, WEBAUTHN]: webauthn
> Enter device name: win-hello
> Follow system dialogs or enter a code from a *registered* OTP device:
<system shows webauthn prompt>
> MFA device "win-hello" added.
```

--------------------------------

### Start Teleport Development Server

Source: https://github.com/gravitational/teleport/blob/master/web/README.md

Starts a local development server that proxies network requests to a Teleport cluster. Replace `example.com:3080` with your cluster's URL. If running a local cluster at `https://localhost:3080`, the `PROXY_TARGET` variable can be omitted.

```bash
PROXY_TARGET=example.com:3080 pnpm start-teleport
```

```bash
pnpm start-teleport
```

--------------------------------

### Clone Teleport Examples Repository

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/zero-trust-access/api/automatically-register-agents.mdx

Clone the Teleport repository to access the service discovery API client example. This sets up the necessary project structure for the guide.

```bash
git clone https://github.com/gravitational/teleport -b branch/v(=teleport.major_version=)
cd teleport/examples/service-discovery-api-client
```

--------------------------------

### Initialize Terraform Starter Cluster

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/installation/self-hosted/deployments/aws-starter-cluster-terraform.mdx

Navigate to the starter cluster directory and initialize Terraform to download provider plugins.

```bash
cd teleport/examples/aws/terraform/starter-cluster
terraform init
```

--------------------------------

### Copy Example Terraform Resource Files

Source: https://github.com/gravitational/teleport/blob/master/integrations/terraform/README.md

Copies example Terraform resource configuration files for users, roles, and provision tokens. Some resources may require prior setup.

```bash
cp example/user.tf.example example/user.tf
cp example/role.tf.example example/role.tf
cp example/provision_token.tf.example example/provision_token.tf
```

--------------------------------

### Example Access Request and Approval

Source: https://github.com/gravitational/teleport/blob/master/rfd/0201-native-auto-approval.md

Demonstrates creating an access request for a specific resource and the subsequent automatic approval process. This example shows the command-line interaction and the approval message received.

```sh
$tsh request create --roles=editor --resource /example.teleport.sh/app/dev-app
Creating request...
Request ID:     <request-id>
Username:       requester
Roles:          editor
Resources:      ["/example.teleport.sh/app/dev-app"]
Status:         PENDING

Waiting for request approval...

Approval received, reason="Access request has been automatically approved by \"@teleport-access-approval-bot\". User \"requester\" is approved by access_monitoring_rule \"demo\"."
Getting updated certificates...

> Profile URL:        https://example.teleport.sh:443
  Logged in as:       requester
  Active requests:    <request-id>
  Cluster:            example.teleport.sh
  Roles:              editor, requester
  Kubernetes:         enabled
  Allowed Resources:  ["/example.teleport.sh/app/dev-app"]
```

--------------------------------

### Define Example Teleport Role

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/machine-workload-identity/access-guides/tctl.mdx

Create a sample role definition in YAML format. This role, `tctl-test`, is a minimal example and can be modified for specific use cases after completing the guide.

```yaml
kind: role
version: v6
metadata:
  name: tctl-test
spec:
  # This role does nothing as it is an example role.
  allow: {}

```

--------------------------------

### Download and Install Event Handler for macOS

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/includes/plugins/install-event-handler.mdx

Download the pre-compiled binary for macOS, extract it, and run the install script. Replace ARCH with your system architecture (e.g., amd64, arm64).

```bash
$ curl -L -O https://cdn.teleport.dev/teleport-event-handler-v(=teleport.version=)-darwin-<Var name="ARCH" />-bin.tar.gz
$ tar -zxvf teleport-event-handler-v(=teleport.version=)-darwin-<Var name="ARCH" />-bin.tar.gz
$ sudo ./teleport-event-handler/install
```

--------------------------------

### Start Local SQL Server Proxy with Teleport

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/includes/database-access/sql-server-connect-note.mdx

Run this command to start a local proxy server for your SQL Server if you do not have `sqlcmd` or `mssql-cli` installed. You can then connect your SQL Server client to this proxy.

```bash
$tsh proxy db --db-user=teleport --tunnel sqlserver
```

--------------------------------

### Connect to Database using psql

Source: https://github.com/gravitational/teleport/blob/master/rfd/0011-database-access.md

Example of how to connect to a database using `psql` after retrieving connection information.

```sh
  $ psql "service=root-postgres user=<user> dbname=<dbname>"
```

--------------------------------

### Install NetIQ Sync Plugin for Teleport

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/identity-security/integrations/netiq.mdx

Install the NetIQ sync plugin for Teleport using the tctl command. This command initiates the setup wizard for configuring the connection between Teleport Access Graph and your NetIQ instance.

```bash
$ tctl plugins install netiq
```

--------------------------------

### Discovery Service Configuration Example

Source: https://github.com/gravitational/teleport/blob/master/rfd/0125-dynamic-auto-discovery-config.md

Example configuration for the discovery service, showing how to enable it and set the discovery group.

```yaml
discovery_service:
  enabled: "yes"
  discovery_group: "my-production-resources"
```

--------------------------------

### Install Entra ID Plugin

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/identity-governance/integrations/entra-id/setup/manual-installation.mdx

Use this command to install the Entra ID plugin for Teleport. The flags specify resource names, authentication connector details, default owners for Access Lists, and indicate a manual setup.

```bash
$ tctl plugins install entraid \
    --name entra-id-default \
    --auth-connector-name entra-id \
    --default-owner=<Var name="Access List owner"/> \
    --no-access-graph \
    --manual-setup
```

--------------------------------

### Database Session Start Audit Event

Source: https://github.com/gravitational/teleport/blob/master/rfd/0011-database-access.md

Example of a `db.session.start` audit event emitted when a user successfully connects to a database.

```json
{
  "code": "TDB00I",
  "db_service": "postgres",
  "db_endpoint": "localhost:5432",
  "db_protocol": "postgres",
  "db_database": "postgres",
  "db_user": "postgres",
  "ei": 0,
  "event": "db.session.start",
  "namespace": "default",
  "server_id": "5603cd43-1172-4f1f-8e35-2bf74dfecf15",
  "sid": "427abfa3-fb1a-4a55-879c-77f5b6257cdb",
  "time": "2020-11-06T03:50:20.802Z",
  "uid": "f12b5199-5a1f-4e48-af4f-6980afffc48e",
  "user": "dev"
}

```

--------------------------------

### tbot Start Command with Joining URI

Source: https://github.com/gravitational/teleport/blob/master/rfd/0205-improved-onprem-joining.md

Demonstrates using a joining URI directly with the 'tbot start identity' command.

```shell
$ tbot start identity tbot+proxy+bound-keypair://example:initial-join-secret@example.teleport.sh:443 ...
```

--------------------------------

### Redis CLI Rendering Example

Source: https://github.com/gravitational/teleport/blob/master/rfd/0171-database-session-playback.md

Illustrates interactions with redis-cli, including SET, HSET, HGETALL, HGET, GET, and exit commands.

```bash
$ redis-cli
127.0.0.1:6379> SET hey 1
OK
127.0.0.1:6379> HSET myhash a 1 b 2 c 3
(integer) 3
127.0.0.1:6379> HGETALL myhash
1) "a"
2) "1"
3) "b"
4) "2"
5) "c"
6) "3"
127.0.0.1:6379> HGET myhash a
"1"
127.0.0.1:6379> GET hey
"1"
127.0.0.1:6379> exit
```

--------------------------------

### dict constructor examples

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/reference/access-controls/login-rules.mdx

Demonstrates the usage of the `dict` constructor to create dictionaries with zero or more key-value pairs.

```go
dict()
```

```go
dict(pair("a", set("x", "y")))
```

--------------------------------

### Terraform Init

Source: https://github.com/gravitational/teleport/blob/master/rfd/0204-aws-iam-roles-anywhere.md

Running `terraform init` will work as expected after configuring the module source.

```bash
terraform init
```

--------------------------------

### Get Teleport Cluster Version

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/configuration/teleport-operator/teleport-operator-standalone.mdx

Retrieves the version of the Teleport cluster. This version is used to specify the operator version during Helm installation.

```bash
export TELEPORT_VERSION=$(tsh version | awk '/Proxy[[:space:]]version/ {print $3}')
echo "$TELEPORT_VERSION"
```

--------------------------------

### tbot Configuration File Example (v2)

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/reference/machine-workload-identity/configuration.mdx

This example demonstrates the structure of a v2 tbot configuration file, including settings for version, debugging, server addresses, and certificate TTL.

```yaml
version: v2

debug: true

auth_server: "teleport.example.com:3025"

proxy_server: "teleport.example.com:443" # or "example.teleport.sh:443" for Teleport Cloud

credential_ttl: "1h"

renewal_interval: "20m"

oneshot: false

onboarding: 
```

--------------------------------

### Local Fluentd Testing with Docker

Source: https://github.com/gravitational/teleport/blob/master/docs/pages/zero-trust-access/export-audit-events/datadog.mdx

Run Fluentd in a local Docker container for testing, installing the Datadog plugin interactively before starting Fluentd.

```bash
$ docker run -u $(id -u root):$(id -g root) -p 8888:8888 -v $(pwd):/keys -v \
$(pwd)/fluent.conf:/fluentd/etc/fluent.conf --entrypoint=/bin/sh -i --tty  fluent/fluentd:edge
# From the container shell:
$ gem install fluent-plugin-datadog
$ fluentd -c /fluentd/etc/fluent.conf
```