Infrastructure Access
Teleport - secure access to Linux, Kubernetes, and infrastructure
Teleport centralizes controlled access to Linux systems, Kubernetes, databases, and internal applications. Short-lived certificates, role-based permissions, and audit data reduce permanently distributed credentials.
What is Teleport?
A Teleport cluster consists at minimum of an Auth Service and a Proxy Service. The Auth Service manages certificate authorities, roles, configuration resources, and audit data. The Proxy routes connections to enrolled services and can provide the externally reachable entry point.
Administrators and platform engineers gain a shared access layer without ignoring the authorization models of target systems. Teleport replaces neither sound Linux, Kubernetes, or database roles nor the identity source and identity provider.
Infrastructure access
Resource-specific services establish controlled connections and produce traceable events.
SSH and Linux
Certificate-based access to Linux systems with roles, resource labels, and session recording.
Kubernetes Access
Access to Kubernetes APIs and kubectl sessions through the controlled access layer.
Database Access
Identity-aware connections to supported databases with protocol-specific audit events.
Application Access
Make internal web and TCP applications available without exposing each application directly.
Machine & Workload Identity
Short-lived identities for automation and services; specific bootstrap and PKI functions depend on the edition.
Four layers of a possible architecture
The chain is an integration example, not a mandatory prerequisite. Each layer retains a distinct responsibility.
1. Identity source
FreeIPA or Red Hat IdM manage users, groups, hosts, Kerberos, and Linux policies.
2. Identity provider
Keycloak or RHBK provide SSO and federation. OIDC/SAML to Teleport require Enterprise.
3. Infrastructure access
Teleport evaluates identity and roles, issues short-lived certificates, and brokers resource access.
4. Target resources
Linux, Kubernetes, databases, and applications retain their technical and business boundaries.
Security and governance
Short-lived credentials help only when paired with a sound role, audit, and emergency-access design.
Short-lived certificates
Time-limited SSH and X.509 certificates reduce credential lifetime.
RBAC
Roles and resource labels constrain logins, protocols, and reachable targets.
Session recording and audit
Sessions and structured events support traceability; storage, privacy, and failure behavior belong in the operating design.
Break glass and lifecycle
Emergency access, certificate rotation, role changes, and cluster recovery require documented, regularly tested procedures.
Distinguishing Community and Enterprise
Based on the official Teleport 18.x feature matrix on 18 October 2026. Recheck before each project.
SSH, Kubernetes, databases, applications
- Community Edition
- Included
- Enterprise
- Included
RBAC, audit, session recording
- Community Edition
- Included
- Enterprise
- Included
SSO
- Community Edition
- GitHub
- Enterprise
- GitHub, OIDC, SAML und weitere
Keycloak OIDC/SAML
- Community Edition
- Not included
- Enterprise
- Included
Access requests and reviews
- Community Edition
- Role requests through CLI
- Enterprise
- Comprehensive governance workflows
Multi-region HA
- Community Edition
- Not included
- Enterprise
- Cloud or self-hosted blueprint
Always verify the edition, license terms, and exact capabilities against current vendor documentation.
Operating Teleport
A secure rollout covers the complete lifecycle, not only sign-in.
Architecture and deployment
Plan Auth, Proxy, agents, network paths, backends, and high availability for the failure model.
TLS and certificates
Document public endpoints, cluster CAs, rotation, and trust chains separately.
Monitoring and audit
Monitor service health, audit pipelines, recording storage, capacity, and failure paths.
Updates and recovery
Pin versions, verify upgrade paths, and test backups and emergency access in practice.
ForgeOne services
ForgeOne supports the path from technical assessment to controlled operational handover.
Architecture and consulting
Define target architecture, edition, trust boundaries, role model, and migration path.
Implementation and integration
Deploy Teleport and connect it to identity, Linux, Kubernetes, database, and application environments.
Automation and hardening
Reproducible configuration with Ansible, secure defaults, and certificate and secret lifecycle.
Operations and knowledge transfer
Monitoring, updates, troubleshooting, runbooks, workshops, and handover to internal teams.
Further reading
The fundamentals article is published. Practical SSH and Keycloak guides follow only after complete lab validation.
Teleport fundamentals
Understand architecture, services, certificates, RBAC, audit, and edition boundaries.
Identity & Access
Place identity source, identity provider, and infrastructure access into one model.
Ansible & automation
Configuration management and infrastructure as code as a basis for reproducible operations.
Frequently asked questions about Teleport
What is Teleport?Show answerHide answer Action: Open answerClose answer
Teleport is a platform for controlled access to infrastructure resources. Its Auth Service, Proxy Service, and resource-specific services connect identities to Linux systems, Kubernetes clusters, databases, and applications.
Does Teleport replace an identity provider?Show answerHide answer Action: Open answerClose answer
No. Teleport can use local users or external SSO, but it replaces neither a central directory such as FreeIPA nor an identity provider such as Keycloak.
Which resources can be connected?Show answerHide answer Action: Open answerClose answer
Teleport 18.x supports Linux servers through SSH, Kubernetes, supported databases, internal web and TCP applications, and other resources listed in the current feature matrix.
How do short-lived SSH certificates work?Show answerHide answer Action: Open answerClose answer
After successful authentication, Teleport issues time-limited certificates. Roles and resource labels determine which logins and systems are reachable during their validity.
What is the difference between Community and Enterprise?Show answerHide answer Action: Open answerClose answer
Community includes the core access services, RBAC, audit, and session recording. OIDC/SAML, comprehensive access reviews, and additional governance capabilities are Enterprise features in the current feature matrix.
Can Teleport integrate with Keycloak?Show answerHide answer Action: Open answerClose answer
Yes. Teleport documents Keycloak through SAML and supports generic OIDC. These SSO options require Teleport Enterprise and deliberate role and claim mapping.
How can Teleport be automated?Show answerHide answer Action: Open answerClose answer
Configuration and resources can be managed as code. Teleport documents interactive Ansible access through OpenSSH or tsh config; unattended workflows need an appropriate Machine & Workload Identity design.
Further content
Curated follow-up content that deepens this topic in a useful way.
Identity & Access with Open Source and Enterprise Platforms
ForgeOne designs Identity & Access architectures with Keycloak, Red Hat build of Keycloak, FreeIPA, Red Hat Identity Management and Univention UCS.
Keycloak
ForgeOne implements Keycloak for single sign-on, OIDC, OAuth 2.0, SAML, MFA, federation, LDAP/AD integration and operations.
FreeIPA
ForgeOne implements FreeIPA for Linux identity management, Kerberos, LDAP, HBAC, sudo policies, SSSD and client enrollment.
Ansible
Ansible engineering for Linux and IT infrastructure: playbooks, roles, collections, testing, GitLab integration and knowledge transfer.
