Teleport: Infrastructure Access with Short-Lived Credentials, RBAC, and Session Audit

TL;DR Teleport is a protocol-aware infrastructure access platform: its Auth Service signs short-lived credentials, while Proxies and Agents mediate SSH, Kubernetes, database, and app access with audit evidence.

#teleport #zero-trust #security #kubernetes #ssh

Table of Contents

Auth is the trust root; Proxy is the entrance
References

Series: Technology Choices in the AI Era (102 / 128)

Twingate: Identity-to-Resource Access Instead of Whole Networks Socket.IO: Realtime Events with Rooms, Acknowledgements, and Recovery

🌏 中文版

Teleport is not a generic VPN. It is an infrastructure access platform aware of SSH, Kubernetes, databases, web apps, Windows desktops, and cloud APIs. It replaces long-lived static credentials with short-lived certificates constrained by identities, roles, and resource labels, while collecting audit events and session recordings.

Auth is the trust root; Proxy is the entrance

The Auth Service maintains certificate authorities, roles, users, connectors, and audit state. The Proxy Service exposes an entry point and routes traffic to private Agents. Agents join through reverse tunnels, verify roles embedded in user certificates, and proxy target resources. Self-hosting makes Auth storage, CA keys, Proxy availability, TLS, backup, and upgrades critical infrastructure; the Cloud edition manages that control plane.

Users authenticate through SSO and MFA in tsh or the Web UI, receive short-lived credentials, and continue with native clients such as ssh, kubectl, and database tools. Label-based RBAC selects resources, while Access Requests enable just-in-time elevation. Design deny rules, session TTL, reviewer separation, and emergency access together. Advanced governance differs by edition, so Community examples are not a complete purchasing specification.

Session recording is useful evidence but may retain commands, screens, and sensitive output. Define access, retention, export, redaction, and fail-open or fail-closed behavior when recording breaks. JWT or mTLS for database and application access still does not implement application-level object authorization.

Machine & Workload Identity uses tbot to renew short-lived credentials for CI and services. Bootstrap tokens remain sensitive, while cloud attestation, renewal failure, and bot-role blast radius need testing. Teleport fits organizations needing JIT, protocol-aware audit, and centralized credential lifecycle. Twingate provides more transparent resource networking; WireGuard and ZeroTier provide network fabric; ngrok provides ingress.

Teleport: Infrastructure Access with Short-Lived Credentials, RBAC, and Session Audit

Auth is the trust root; Proxy is the entrance

References

Related