# Teleport

Source: https://forgeone.solutions/en/products/teleport
Language: en
Published: 2026-10-17
Updated: 2026-10-17

ForgeOne designs and implements Teleport for short-lived SSH certificates, Kubernetes, database and application access, RBAC, auditing, and secure operations.

Infrastructure Access

## Teleport - secure access to Linux, Kubernetes, and infrastructure

Teleport centralizes controlled access to Linux systems, Kubernetes, databases, and internal applications. Short-lived certificates, role-based permissions, and audit data reduce permanently distributed credentials.

- [Discuss a Teleport project](https://forgeone.solutions/en/contact#book-appointment)

[![Architecture illustration of a central access layer between identities and infrastructure resources](https://forgeone.solutions/media/teleport-infrastructure-access-hero.webp)](https://forgeone.solutions/media/teleport-infrastructure-access-hero.webp)

## What is Teleport?

A Teleport cluster consists at minimum of an Auth Service and a Proxy Service. The Auth Service manages certificate authorities, roles, configuration resources, and audit data. The Proxy routes connections to enrolled services and can provide the externally reachable entry point.

Administrators and platform engineers gain a shared access layer without ignoring the authorization models of target systems. Teleport replaces neither sound Linux, Kubernetes, or database roles nor the identity source and identity provider.

## Infrastructure access

Resource-specific services establish controlled connections and produce traceable events.

### SSH and Linux

Certificate-based access to Linux systems with roles, resource labels, and session recording.

### Kubernetes Access

Access to Kubernetes APIs and kubectl sessions through the controlled access layer.

### Database Access

Identity-aware connections to supported databases with protocol-specific audit events.

### Application Access

Make internal web and TCP applications available without exposing each application directly.

### Machine & Workload Identity

Short-lived identities for automation and services; specific bootstrap and PKI functions depend on the edition.

## Four layers of a possible architecture

The chain is an integration example, not a mandatory prerequisite. Each layer retains a distinct responsibility.

### 1. Identity source

FreeIPA or Red Hat IdM manage users, groups, hosts, Kerberos, and Linux policies.

- [View FreeIPA](https://forgeone.solutions/en/products/freeipa)

### 2. Identity provider

Keycloak or RHBK provide SSO and federation. OIDC/SAML to Teleport require Enterprise.

- [View Keycloak](https://forgeone.solutions/en/products/keycloak)

### 3. Infrastructure access

Teleport evaluates identity and roles, issues short-lived certificates, and brokers resource access.

- [Read the fundamentals](https://forgeone.solutions/en/tech/teleport-secure-infrastructure-access)

### 4. Target resources

Linux, Kubernetes, databases, and applications retain their technical and business boundaries.

## Security and governance

Short-lived credentials help only when paired with a sound role, audit, and emergency-access design.

### Short-lived certificates

Time-limited SSH and X.509 certificates reduce credential lifetime.

### RBAC

Roles and resource labels constrain logins, protocols, and reachable targets.

### Session recording and audit

Sessions and structured events support traceability; storage, privacy, and failure behavior belong in the operating design.

### Break glass and lifecycle

Emergency access, certificate rotation, role changes, and cluster recovery require documented, regularly tested procedures.

## Distinguishing Community and Enterprise

Based on the official Teleport 18.x feature matrix on 18 October 2026. Recheck before each project.

| Feature | Community Edition | Enterprise |
| --- | --- | --- |
| SSH, Kubernetes, databases, applications | Included | Included |
| RBAC, audit, session recording | Included | Included |
| SSO | GitHub | GitHub, OIDC, SAML und weitere |
| Keycloak OIDC/SAML | Not included | Included |
| Access requests and reviews | Role requests through CLI | Comprehensive governance workflows |
| Multi-region HA | Not included | Cloud or self-hosted blueprint |

Always verify the edition, license terms, and exact capabilities against current vendor documentation.

- [Current feature matrix](https://goteleport.com/docs/feature-matrix/)

## Operating Teleport

A secure rollout covers the complete lifecycle, not only sign-in.

### Architecture and deployment

Plan Auth, Proxy, agents, network paths, backends, and high availability for the failure model.

### TLS and certificates

Document public endpoints, cluster CAs, rotation, and trust chains separately.

### Monitoring and audit

Monitor service health, audit pipelines, recording storage, capacity, and failure paths.

### Updates and recovery

Pin versions, verify upgrade paths, and test backups and emergency access in practice.

## ForgeOne services

ForgeOne supports the path from technical assessment to controlled operational handover.

### Architecture and consulting

Define target architecture, edition, trust boundaries, role model, and migration path.

### Implementation and integration

Deploy Teleport and connect it to identity, Linux, Kubernetes, database, and application environments.

### Automation and hardening

Reproducible configuration with Ansible, secure defaults, and certificate and secret lifecycle.

### Operations and knowledge transfer

Monitoring, updates, troubleshooting, runbooks, workshops, and handover to internal teams.

## Further reading

The fundamentals article is published. Practical SSH and Keycloak guides follow only after complete lab validation.

### Teleport fundamentals

Understand architecture, services, certificates, RBAC, audit, and edition boundaries.

- [Read article](https://forgeone.solutions/en/tech/teleport-secure-infrastructure-access)

### Identity & Access

Place identity source, identity provider, and infrastructure access into one model.

- [Open IAM hub](https://forgeone.solutions/en/products/identity-access)

### Ansible & automation

Configuration management and infrastructure as code as a basis for reproducible operations.

- [View Ansible](https://forgeone.solutions/en/products/ansible)

## Frequently asked questions about Teleport

### What is Teleport?

Teleport is a platform for controlled access to infrastructure resources. Its Auth Service, Proxy Service, and resource-specific services connect identities to Linux systems, Kubernetes clusters, databases, and applications.

### Does Teleport replace an identity provider?

No. Teleport can use local users or external SSO, but it replaces neither a central directory such as FreeIPA nor an identity provider such as Keycloak.

### Which resources can be connected?

Teleport 18.x supports Linux servers through SSH, Kubernetes, supported databases, internal web and TCP applications, and other resources listed in the current feature matrix.

### How do short-lived SSH certificates work?

After successful authentication, Teleport issues time-limited certificates. Roles and resource labels determine which logins and systems are reachable during their validity.

### What is the difference between Community and Enterprise?

Community includes the core access services, RBAC, audit, and session recording. OIDC/SAML, comprehensive access reviews, and additional governance capabilities are Enterprise features in the current feature matrix.

### Can Teleport integrate with Keycloak?

Yes. Teleport documents Keycloak through SAML and supports generic OIDC. These SSO options require Teleport Enterprise and deliberate role and claim mapping.

### How can Teleport be automated?

Configuration and resources can be managed as code. Teleport documents interactive Ansible access through OpenSSH or tsh config; unattended workflows need an appropriate Machine & Workload Identity design.

- [Discuss your project](https://forgeone.solutions/en/contact#book-appointment)