Deploy Machine ID
The first step to set up Machine ID is to deploy the tbot binary and join a
Machine ID bot to your Teleport cluster. You can run the tbot binary on a
number of platforms, from AWS and GitHub Actions to a generic Linux server or
Kubernetes cluster. This guide shows you how to deploy Machine ID on your
infrastructure.
Choosing a deployment method
There are two considerations to make when determining how to deploy Machine ID on your infrastructure.
Your infrastructure
The tbot binary runs as a container or on a Linux virtual machine. If you run
tbot on GitHub Actions, you can use one of the ready-made Teleport GitHub
Actions workflows.
Join method
Machine ID joins your Teleport cluster by using one of the following authentication methods:
- Platform-signed document: The platform that hosts
tbot, such as a Kubernetes cluster or Amazon EC2 instance, provides a signed identity document that Teleport can verify using the platform's certificate authority. This is the recommended approach because it avoids the use of shared secrets. - Static join token: Your Teleport client tool generates a string and stores it on the Teleport Auth Service. Machine ID provides this string when it first connects to your Teleport cluster, demonstrating to the Auth Service that it belongs in the cluster. From then on, Machine ID authenticates to your Teleport cluster with a renewable certificate.
Deployment guides
The guides in this section show you how to deploy Machine ID and join it to your cluster. Choose a guide based on the platform where you intend to run Machine ID.
If a specific guide does not exist for your platform, the Linux guide is compatible with most platforms. For custom approaches, you can also read the Machine ID Reference and Architecture to plan your deployment.
Self-hosted infrastructure
Read the following guides for how to deploy Machine ID on your cloud platform or on-prem infrastructure.
| Platform | Installation method | Join method |
|---|---|---|
| Linux | Package manager or TAR archive | Static join token |
| Linux (TPM) | Package manager or TAR archive | Attestation from TPM 2.0 |
| GCP | Package manager, TAR archive, or Kubernetes pod | Identity document signed by GCP |
| AWS | Package manager, TAR archive, or Kubernetes pod | Identity document signed by AWS |
| Azure | Package manager or TAR archive | Identity document signed by Azure |
| Kubernetes | Kubernetes pod | Identity document signed by your Kubernetes cluster |
CI/CD
Read the following guides for how to deploy Machine ID on a continuous integration and continuous deployment platform
| Platform | Installation method | Join method |
|---|---|---|
| Bitbucket Pipelines | TAR archive | Bitbucket-signed identity document |
| CircleCI | TAR archive | CircleCI-signed identity document |
| GitLab | TAR archive | GitLab-signed identity document |
| GitHub Actions | Teleport job available through the GitHub Actions marketplace | GitHub-signed identity document. |
| Jenkins | Package manager or TAR archive | Static join token |
| Spacelift | Docker Image | Spacelift-signed identity document |
| Terraform Cloud | Teleport Terraform Provider via Teleport's Terraform Registry | Terraform Cloud-signed identity document |