Who accessed a given server, database, or Kubernetes cluster, and what did they do there?

every SSH, Kubernetes, database, RDP, and web session is recorded and tied to an authenticated identity, so the activity can be replayed or reviewed after the fact

Can someone still get in with a credential from a machine that was decommissioned months ago?

access runs through short-lived certificates issued at connection time instead of long-lived keys or passwords, so there is no standing credential left to revoke

How does a contractor get temporary access to a production database without a new VPN account?

just-in-time access requests grant elevated roles for a bounded window, approved through the same identity and access layer used for standing access

Is there one place to see every human and machine identity that can reach infrastructure across servers, Kubernetes, databases, and clouds?

a single identity and access layer applies SSO and consistent role checks across all protected protocols, so the same identity model governs SSH, Kubernetes, database, RDP, web, and cloud API access

Can a remote server behind a NAT or firewall be reached without opening a VPN or standing up a bastion host?

the service establishes an outbound tunnel from the protected resource, letting connections reach it without inbound network access or a bastion in between

teleport release history — The Cyber Toolchain

docs update Aug 12, 2026 · issue 043

Teleport adds teleport-acl-lifecycle agent skill for managing access list lifecycle via AI-driven workflows.

Adds teleport-acl-lifecycle skill enabling agents to browse available servers, databases, applications, and Kubernetes clusters, then create, update, or retire access lists that grant users access to those resources.

1 detail in Everything

v18.10.0 Jul 9, 2026 · release notes

New tsh apps logins command for querying cloud app logins and Sub CA management commands.

└──▷ GET THIS VERSION

$ git clone --branch v18.10.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.10.0

Adds tsh apps logins subcommand to query available logins for cloud applications (currently AWS).
Adds tctl auth update-override subcommand as a user-friendly alternative for managing Sub CAs.
Adds tctl auth delete-override subcommand as a user-friendly alternative for removing Sub CA overrides.
Allows sharing multiple directories in a single RDP session and unmounting them without closing the session.

4 details in Everything

v18.9.2 Jun 29, 2026 · release notes

Adds tctl auth create-override command and scoped role capabilities including locking mode and session recording modes

└──▷ GET THIS VERSION

$ git clone --branch v18.9.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.9.2

Added the Sub CA tctl auth create-override command, a user-friendly alternative over tctl create ca_override.yaml
Add locking mode, disconnect expired cert, enhanced session recording, and session recording mode to scoped roles
Add scope support for openSSH and proxy recording mode
Add --interactive flag to prompt for role from stdin if --interactive flag is provided

4 details in Everything

v18.9.0 Jun 18, 2026 · release notes

Teleport v18.9.0 adds Device Bound Session Credentials for app access, Windows high-DPI desktops, and sub-CA support.

└──▷ GET THIS VERSION

$ git clone --branch v18.9.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.9.0

Application session cookies now support Google's Device Bound Session Credentials to protect against hijacking
Windows remote desktop sessions gain high-DPI mode for clearer display rendering
Teleport can operate as a sub-CA of an external root for Windows Desktop and Database Client CAs

3 details in Everything

v18.8.3 Jun 5, 2026 · release notes

Adds tsh workload-identity issue-jwt command for JWT-SVID issuance and identity/key-agent service to tbot.

└──▷ GET THIS VERSION

$ git clone --branch v18.8.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.8.3

Introduced tsh workload-identity issue-jwt command for human issuance of JWT-SVIDs.
Added identity/key-agent service to enable tbot to generate un-exfiltratable credentials.
Added web_terminal_clipboard_mode role option to restrict copying text from a web terminal SSH session.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The embedded session helper functionality is now disabled by default, requiring setting the TELEPORT_UNSTABLE_DISABLE_EMBEDDED_REEXEC environment variable to no to enable it.

v17.7.24 Jun 2, 2026 · release notes

Teleport v17.7.24 raises app access upstream response-header cap to 1 hour for long-running requests.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.24 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.24

Enterprise licenses with a devices limit for device trust can now enroll unlimited devices.

1 detail in Everything

v18.8.2 May 22, 2026 · release notes

Teleport v18.8.2 adds SCIM-synced access list badges in web UI and improves reliability of Okta assignments processing

└──▷ GET THIS VERSION

$ git clone --branch v18.8.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.8.2

└──▷ HOW TO FIND IT

Identify which access lists are managed via SCIM rather than manually within the Teleport web UI.

📍Log in to the Teleport web console, navigate to Access Lists, and look for the badge next to list names.

SCIM-synced access lists now display a badge in the web UI to distinguish them from manually managed lists.
Okta assignments processing has been improved for greater reliability during synchronization.

2 details in Everything

v18.8.1 May 15, 2026 · release notes

Teleport v18.8.1 adds Kubernetes join service account targeting, extends app access headers, and improves UI error messaging

└──▷ GET THIS VERSION

$ git clone --branch v18.8.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.8.1

└──▷ USE IT

Restrict Kubernetes cluster joining to specific service accounts within specific namespaces, using wildcards for flexibility.

yaml

# In teleport.yaml
categories:
- kind: kubernetes
  allow:
    rules:
    - service_account_names: ['teleport-bot-*']
      namespaces: ['production', 'staging']

View the leaf cluster name in your terminal MFA prompt when authenticating to a resource in a multi-cluster topology.

📍# tsh will now display the leaf cluster name in the interactive prompt # Example output: # Cluster: prod-us-east # Cluster (leaf): prod-eu-west # Username: admin

kubernetes.join_method allow rules now support service_account_names and namespaces with wildcard support for granular cluster joining control.
App access upstream response-header cap increased to 1 hour, enabling long-running HTTP requests through Teleport to complete successfully.
MFA prompts in tsh and Teleport Connect display the leaf cluster name for resources belonging to a leaf cluster.
Web app access via Device Trust now serves an HTML page (instead of plain text) when the browser originates from an untrusted device.

4 details in Everything

v18.8.0 May 12, 2026 · release notes

Adds VNet for Linux, tsh MFA via browser, bound keypair joining for agents, and session summaries search.

└──▷ GET THIS VERSION

$ git clone --branch v18.8.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.8.0

Extends Teleport VNet support to Linux workstations
Delegates tsh MFA checks to the browser for passkey/password manager use
Adds bound keypair join method support for arbitrary Teleport agents
Enables natural language search of session summaries via new Identity Security CLI tooling
Supports RDP connections to Windows hosts in different Active Directory domains

+8 more show less

Adds Terraform module support for AWS EKS discovery at the account level
Adds Terraform configuration generation for access list workflows in the web UI
Permits per-machine and per-user installation modes for Teleport Connect on Windows
Shows specific IAM roles available during AWS privilege escalation requests in Access Requests
Adds tsh beams subcommand for the Beams public beta
Extends tctl discovery nodes to include Azure VM resources for troubleshooting enrollment
Adds support for WorkloadIdentity with --apply-on-startup and --bootstrap flags in tbot
Introduces user traits filtering in the web UI Access List creation wizard

13 details in Everything

└──▷ BREAKING ON UPGRADE

!Teleport Connect Windows now only supports automatic upgrades; downgrades must be performed manually.
!The environment variables TELEPORT_CDN_BASE_URL and TELEPORT_TOOLS_VERSION are deprecated for Teleport Connect Windows updates; configure via system policy registry keys under HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\SOFTWARE\Policies\Teleport\TeleportConnect.
!Automatic updates in Teleport Connect no longer allow app version downgrades (applies to all platforms).

v18.7.6 Apr 30, 2026 · release notes

Teleport v18.7.6 adds scoped roles in Terraform/k8s operators, new CLI commands, and expanded SSH/scoped role capabilities.

└──▷ GET THIS VERSION

$ git clone --branch v18.7.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.7.6

└──▷ USE IT

Troubleshoot why AWS EC2 nodes aren't being enrolled in Teleport.

shell

tctl discovery nodes

Adds tctl discovery nodes command for troubleshooting AWS EC2 auto-discovery enrollment issues.
Adds skip_initial_connection option to the teleportmwi provider to allow lazy initialization of the provider.
Adds ui_config resource support to the Terraform provider.
Added current and previous resources discovered summary per service to Discovery Config Status.
Added lock resource support to the Kubernetes operator.

+13 more show less

Added scoped role assignment support to the Terraform provider.
Added scoped roles support to the Terraform provider.
Added scoped role assignments to the k8s operator.
Added scoped role to the k8s operator.
Added teleport_app_active_sessions Prometheus gauge with app label for app access agent autoscaling.
Added support for Azure join tokens based on Azure tenant ID.
Added user.metadata.name variable to RBAC role templates and expressions.
Add x11 forwarding, SSH File Copying, Agent Forwarding, SSH Port Forwarding, Create Host User, Max Sessions, and host sudoers to scoped ssh role options.
Standard Teleport agents can now join using the bound_keypair join method.
Add support for * and $ globbing to the GitHub Actions token rules.
Extended access monitoring predicate language with contains(set, item) expression.
Added visible teleport.dev/ labels for Azure and GCP auto-discovered VMs.
Add SAML IdP Service Provider support to Terraform provider.

18 details in Everything

└──▷ BREAKING ON UPGRADE

!Auth connector names are now limited to 768 characters.

v17.7.23 Apr 30, 2026 · release notes

Adds teleport_app_active_sessions Prometheus gauge with app label for autoscaling insights.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.23 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.23

v17.7.20 Mar 6, 2026 · release notes

Adds tctl recordings download subcommand to fetch session recordings locally without backend access.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.20 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.20

└──▷ USE IT

Download all session recordings for a specific user from a remote Teleport cluster to a local directory.

shell

tctl recordings download --user alice --dest ./recordings

v18.7.2 Mar 6, 2026 · release notes

v18.7.2 adds TeleportAccessMonitoringRuleV1 and session summarizer support to the Kubernetes operator, plus scoped token updates to tctl.

└──▷ GET THIS VERSION

$ git clone --branch v18.7.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.7.2

Adds update scoped token support to tctl and removes the status requirement from the upsert scoped token RPC
Adds scoped tokens to tctl resource commands

2 details in Everything

v18.7.1 Feb 25, 2026 · release notes

Teleport v18.7.1 adds UpsertScopedToken RPC and platform info for EC2 discovery.

└──▷ GET THIS VERSION

$ git clone --branch v18.7.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.7.1

server side secret obfuscating is enabled for GetScopedTokens RPC
New UpsertScopedToken RPC is available
ssm.run events now include platform information when auto discovering EC2 instances

3 details in Everything

v18.7.0 Feb 17, 2026 · release notes

Teleport v18.7.0 adds inventory UI, tctl recordings download, AWS org-level EC2 auto-discovery, and more.

└──▷ GET THIS VERSION

$ git clone --branch v18.7.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.7.0

└──▷ USE IT

Download session recordings locally without needing direct S3 or GCS backend access.

shell

tctl recordings download <recording-id>

Run tsh status in environments where the Teleport server is unreachable or to save API calls.

shell

tsh status --client

Configure static labels for Windows desktops discovered via LDAP.

config

# In your teleport.yaml
autodiscovery:
  windows_desktop:
    discovery_config:
      static_labels:
        - key: "team"
          value: "windows-ops"

tsh status gains a --client flag to skip server-side operations in client-only mode
Adds the tctl recordings download subcommand to download session recordings without backend access
AWS EC2 auto-discovery now supports organization-level enrollment from all or subset of accounts
New discovery_config.static_labels field allows static labels for LDAP-discovered Windows desktops
tsh kubectl tracing enabled via the --trace flag

+4 more show less

tbot start supports the new no-op subcommand to start no services
Inventory UI shows complete inventory of all connected instances and bots
Entra ID integration status page available in the web UI
Managed Updates dashboard added to the WebUI for configuration and rollout monitoring

9 details in Everything

v18.6.8 Feb 10, 2026 · release notes

tsh proxy kube now supports custom command execution via --exec-cmd and --exec-arg flags

└──▷ GET THIS VERSION

$ git clone --branch v18.6.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.6.8

└──▷ USE IT

Launch a local interactive terminal UI like k9s against a proxied Kubernetes cluster using the new execution flags.

shell

tsh proxy kube --exec-cmd k9s

v17.7.18 Feb 10, 2026 · release notes

Teleport v17.7.18 adds Access Monitoring for Cloud External Audit Storage and extends macOS support.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.18

Extends Access Monitoring feature to Teleport Cloud customers using External Audit Storage.
Adds recording and validation for fixed OS login user values from tsh in Access Monitoring.

2 details in Everything

v18.6.7 Feb 9, 2026 · release notes

Teleport v18.6.7 adds cert-manager support for event-handler Helm chart

└──▷ GET THIS VERSION

$ git clone --branch v18.6.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.6.7

Requires minimum macOS 12 (Monterey) for Teleport client tools and Teleport Connect
Modifies default token value in tbot helm chart to simplify deployment

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The minimum macOS version is raised to 12 (Monterey); clients on earlier versions will no longer function.

v18.6.6 Feb 3, 2026 · release notes

Adds Helm chart support to teleport-event-handler configure and tctl resource removal for okta_assignment.

└──▷ GET THIS VERSION

$ git clone --branch v18.6.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.6.6

└──▷ TRY IT

Generate a Helm chart configuration using the event handler tool.

$ teleport-event-handler configure --helm

Remove a lingering Okta assignment resource via tctl.

$ tctl rm okta_assignment/<id>

teleport-event-handler configure now supports generating or managing Helm charts.
tctl adds ability to remove okta_assignment internal resources.

2 details in Everything

v17.7.16 Feb 3, 2026 · release notes

Teleport v17.7.16 adds multi-arch lock file support in the Terraform provider.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.16

v18.6.5 Jan 29, 2026 · release notes

New tctl alerts rm command, tbot SPIFFE DaemonSet chart, and MCP ID token injection

└──▷ GET THIS VERSION

$ git clone --branch v18.6.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.6.5

└──▷ TRY IT

Remove a specific alert from the cluster using its ID.

$ tctl alerts rm <alertID>

Install tbot as a systemd service with a custom PID file location for better process management.

$ tbot systemd install --pid-file /var/run/tbot.pid

Deploy tbot agents as a DaemonSet to serve SPIFFE SVIDs to local Kubernetes pods.

$ helm install tbot-spiffe-daemon-set <chart-path>

Added the tctl alerts rm <alertID> command to delete specific cluster alerts.
Added support for injecting Teleport-issued ID tokens into outgoing MCP requests for OAuth/OIDC validation.
Introduced the tbot-spiffe-daemon-set Helm chart for deploying tbot agents via SPIFFE Workload API in Kubernetes.
Added the --pid-file flag to the tbot systemd install command.
Added opt-in support to bootstrap the teleport-plugin-event-handler Helm chart with Multi-Cluster Instance (MWI) auto-join capabilities.

+3 more show less

Exported additional_trusted_keys in tctl auth export and the /webapi/auth/export endpoint to include certificates from the init rotation phase.
Implemented tctl get cert_authority/catype subcommand alongside existing certificate authority retrieval commands.
Added a Terraform module to configure Teleport and AWS for EC2 discovery in an AWS account.

8 details in Everything

v17.7.15 Jan 27, 2026 · release notes

Adds --pid-file flag to tbot systemd install command for custom PID file paths.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.15 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.15

└──▷ USE IT

Install tbot as a systemd service with the PID file stored in /var/run/custom/tbot.pid instead of the default location.

shell

tbot systemd install --pid-file=/var/run/custom/tbot.pid

v18.6.4 Jan 21, 2026 · release notes

Teleport v18.6.4 adds tbot wait API, teleport debug commands, and AWS Console URL support

└──▷ GET THIS VERSION

$ git clone --branch v18.6.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.6.4

Adds tbot wait API and helper to let scripts wait for bots to become ready
Adds teleport debug metrics command
Adds teleport debug readyz command
Add quicksight.aws.amazon.com as valid URL for AWS Console access
Made the teleport-cluster Helm chart job resources configurable again via the jobResources value

+1 more show less

Added automatic client certificate reloading option for postgres backends

6 details in Everything

v17.7.13 Jan 8, 2026 · release notes

Teleport v17.7.13 adds support for new AWS regions in IAM joining and respects region field in external audit storage configuration.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.13

v18.6.0 Dec 23, 2025 · release notes

Teleport v18.6.0 adds Identifier-first login enhancements, GitHub Actions Kubernetes Wizard, and auth backoff config.

└──▷ GET THIS VERSION

$ git clone --branch v18.6.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.6.0

Adds auth_connection_config global configuration section to control Proxy/Agent backoff behavior
Adds teleport-plugin-event-handler Helm chart annotations support
Adds extraArgs, extraEnv, and extraLabels patterns to the teleport-plugin-event-handler Helm chart
Adds full environment variable configuration for the event handler CLI

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The default Managed Updates v2 update group is corrected to default from stable/cloud

v18.5.1 Dec 12, 2025 · release notes

Adds --format flag to tsh request search, Terraform support for teleport_integration and DiscoveryConfig resources, and tsh recording ls CLI

└──▷ GET THIS VERSION

$ git clone --branch v18.5.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.5.1

└──▷ TRY IT

Export access request search results to JSON for external processing

$ tsh request search --format json

List application session recordings via CLI

$ tsh recording ls

Added Terraform provider support for teleport_integration resources
DiscoveryConfig resources can now be managed via the Teleport Terraform Provider
Added support for listing application session recordings in tsh recording ls and the Web UI

3 details in Everything

v17.7.11 Dec 9, 2025 · release notes

Adds tctl ability to update existing Azure OIDC integrations and a new Workload Identities UI page.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.11

Adds ability to update existing Azure OIDC integration with tctl
Adds a Workload Identities page to the web UI to list workload identities

2 details in Everything

v18.5.0 Dec 4, 2025 · release notes

Teleport v18.5.0 adds Kubernetes relay support, SCIM PATCH, and improved EC2 discovery

└──▷ GET THIS VERSION

$ git clone --branch v18.5.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.5.0

Adds Kubernetes connectivity support to the Relay Service, allowing it to facilitate connections to Kubernetes clusters.
Introduces SCIM PATCH operations for SailPoint integrations, improving reliability of bulk identity synchronization via the Teleport SCIM server.
Enables discovery of EC2 instances in all regions without requiring enumeration, utilizing the account.ListRegions IAM permission.
Allows Azure resource discovery to authenticate using Azure OIDC integrations instead of traditional credentials.
Configures GOMEMLIMIT to default to 90% of configured memory limits in teleport-cluster, teleport-kube-agent, and teleport-relay Helm charts to reduce OOM-Killed risk.

5 details in Everything

v18.4.2 Dec 1, 2025 · release notes

Adds --roles flag to tsh request search, User Details view in Web UI, and Azure OIDC update via tctl

└──▷ GET THIS VERSION

$ git clone --branch v18.4.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.4.2

Adds --roles flag for tsh request search, allowing users to list all requestable roles.
Added ability to update existing Azure OIDC integration with tctl.

2 details in Everything

v18.4.1 Nov 20, 2025 · release notes

Adds tctl scoped tokens commands and scoped cluster join support for SSH nodes in v18.4.1

└──▷ GET THIS VERSION

$ git clone --branch v18.4.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.4.1

└──▷ TRY IT

Create a scoped token that limits an SSH node's access to a specific organizational scope during cluster join.

$ tctl scoped tokens add --scope engineering --ttl 24h

List existing scoped tokens to audit which scopes have active join credentials.

$ tctl scoped tokens ls

Adds tctl scoped tokens add, ls, and rm subcommands to create, list, and remove scoped tokens.
Enables SSH nodes to join a Teleport cluster within a particular scope using a scoped token.

2 details in Everything

v18.4.0 Nov 14, 2025 · release notes

Teleport v18.4.0 adds MCP Zero-Trust HTTP transport, tsh scp cross-host support, env0 join method, and bot instance management improvements

└──▷ GET THIS VERSION

$ git clone --branch v18.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.4.0

role.spec.allow.request.reason.prompt allows configuring custom reason prompts for Access Requests per role/resource
New env0 join method supports joining teleport instances within Env0 workflows
Supports MCP Zero-Trust Access over HTTP transport protocols in addition to stdio
Added a new OCI join method that does not require IAM policies
tbot now supports teleport-update for automated updates

5 details in Everything

v18.3.2 Nov 7, 2025 · release notes

Teleport v18.3.2 adds Amazon Bedrock support for session recording summarizer in Enterprise edition.

└──▷ GET THIS VERSION

$ git clone --branch v18.3.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.3.2

v17.7.9 Nov 6, 2025 · release notes

Adds extraEnv and extraArgs to teleport-operator Helm chart and editing bot descriptions in UI

└──▷ GET THIS VERSION

$ git clone --branch v17.7.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.9

└──▷ HOW TO FIND IT

Update a bot's description directly through the web interface.

📍In the Teleport UI, navigate to Access Requests or Bots and select the bot to edit its description field.

Added editing bot description to the web UI.

1 detail in Everything

v18.3.1 Nov 5, 2025 · release notes

Adds tsh mcp config/connect custom headers, Windows Desktop KDC DNS discovery, and OIDC creds in tctl AWS Identity Center plugin

└──▷ GET THIS VERSION

$ git clone --branch v18.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.3.1

Adds support for custom HTTP headers in tsh mcp config/connect commands when connecting to streamable-HTTP MCP servers
Enables the Windows Desktop service to automatically discover the KDC server address via DNS lookup
Allows setting OIDC Integration credentials directly within the tctl aws identity-center plugin installer flow
Supports specifying topologySpreadConstraints in the teleport-kube-agent Helm chart for pod placement control
Enables summarization and metadata generation for encrypted session recordings, storing these assets in encrypted form

5 details in Everything

v18.3.0 Oct 30, 2025 · release notes

Adds Relay Service for SSH proxying, ElastiCache Serverless support, and Web UI Workload ID listing

└──▷ GET THIS VERSION

$ git clone --branch v18.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.3.0

Introduces the teleport relay service to act as a lightweight proxy for SSH connections, allowing clients and agents to bypass the control plane in large deployments.
Adds a Workload Identities page in the Web UI to list all workload identity resources registered in the cluster.
Enables continuous health monitoring of registered Kubernetes clusters with status display in the web UI and automatic routing to healthy services.
Allows multiple Teleport clusters to simultaneously discover the same EC2 instances via auto-discovery without interference.
Adds time_between_imports setting to Okta plugin configuration to control import frequency.

+4 more show less

Adds support for regex conditions in AccessMonitoringRule policies.
Adds support for SSE and streamable-HTTP MCP servers in Teleport's capabilities.
Enables schedule configuration for Access Automation Rules directly within the Web UI.
Updates Entra ID plugin installation UI to support group filter configuration.

9 details in Everything

v18.2.10 Oct 24, 2025 · release notes

Teleport v18.2.10 adds tbot start ssh-multiplexer, bot description editing, and schedule support in access monitoring rules

└──▷ GET THIS VERSION

$ git clone --branch v18.2.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.2.10

└──▷ TRY IT

Start an SSH multiplexer service instance from the command line without providing a separate configuration file.

$ tbot start ssh-multiplexer

Adds tbot start ssh-multiplexer subcommand to start the SSH multiplexer service without a config file
Enables use of schedules within automatic review and notification access_monitoring_rules
Adds extraEnv and extraArgs Helm chart values for teleport-operator
Adds PodSecurityContext support to the tbot Helm chart

4 details in Everything

v17.7.8 Oct 15, 2025 · release notes

Teleport v17.7.8 adds PodSecurityContext to tbot helm chart and a teleport_bot_instances metric

└──▷ GET THIS VERSION

$ git clone --branch v17.7.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.8

└──▷ TRY IT

Monitor the number of active bot instances in your Grafana dashboards.

$ sum by(instance) (teleport_bot_instances)

tbot helm chart now supports the podSecurityContext field
Adds the teleport_bot_instances metric for monitoring bot instances

2 details in Everything

v18.2.4 Oct 2, 2025 · release notes

Teleport v18.2.4 adds EC2/GCP/Azure server auto-discovery and Kubernetes recording context name templating

└──▷ GET THIS VERSION

$ git clone --branch v18.2.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.2.4

Added support for multiple agents in EC2, GCP and Azure Server auto discovery, allowing server access from different Teleport clusters
Added support for customizing context names with a template in kubernetes/v2 output
Changed the event-handler plugin to skip over Windows desktop session recording events by default

3 details in Everything

v18.2.3 Sep 29, 2025 · release notes

Adds tbot application-proxy service and copy-binaries CLI; adds @<project-id>.iam suffix for GCP Postgres usernames.

└──▷ GET THIS VERSION

$ git clone --branch v18.2.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.2.3

Introduces application-proxy service to tbot for HTTP proxying to applications protected by Teleport
Added tctl tokens configure-kube helper command to easily trust Kubernetes clusters and allow secure repeatable joining
Added tbot copy-binaries command to simplify using tbot as a Kubernetes sidecar
Added automatic @<project-id>.iam suffix to GCP Postgres usernames (Teleport Connect)
Added support for generating VSCode and Claude Code MCP servers configurations to the tsh mcp config and tsh mcp db config commands

+1 more show less

Allow controlling the description of auto-discovered Kubernetes apps with an annotation

6 details in Everything

v17.7.7 Sep 29, 2025 · release notes

Adds application-proxy service to tbot for HTTP proxying to applications protected by Teleport.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.7

v17.7.5 Sep 19, 2025 · release notes

Teleport v17.7.5 adds bound_keypair join method, tctl SCIM token updates, and multi-resource editing in tctl edit.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.5

└──▷ TRY IT

Create a new bound_keypair join token for machine authentication in environments without platform-specific join methods.

$ tctl create -f - <<EOF
apiVersion: teleport.dev/v1alpha1
kind: Token
metadata:
  name: my-bound-token
type: kubernetes
spec:
  onboarding:
    bound_keypair: true
EOF

Adds bound_keypair as a new join method for Machine and Workload ID via the spec.onboarding resource field
Adds ability to update AWS Identity Center SCIM token using a new tctl subcommand
Enables editing multiple resources simultaneously in tctl edit when working with collections
Allows controlling description of auto-discovered Kubernetes apps via an annotation

4 details in Everything

v16.5.16 Sep 19, 2025 · release notes

Teleport v16.5.16 adds install group config, fdpass binary, K8s app description annotation, and improved audit event details

└──▷ GET THIS VERSION

$ git clone --branch v16.5.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.16

Install script supports specifying a --group argument when installing agents with managed updates V2 enabled
New fdpass-teleport binary is now included in Teleport tar downloads for install scripts
Auto-discovered Kubernetes apps can be described using the apps.gravitational.io/description annotation
Windows Directory and Clipboard audit events now include the desktop name field

4 details in Everything

v17.7.4 Sep 9, 2025 · release notes

Adds default namespace support for tbot kubeconfig generation and SCIM plugin configuration with OIDC/GitHub connectors

└──▷ GET THIS VERSION

$ git clone --branch v17.7.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.4

└──▷ HOW TO FIND IT

View, lock, unlock, or delete a bot's lifecycle status directly via the web UI.

📍1. Navigate to Identity › Bots. 2. Select a bot. 3. Use the new Lock, Unlock, or Delete buttons on the Bot Details page.

Added default_namespace config option to tbot for controlling the Kubernetes namespace in generated kubeconfig files
Added Lock, unlock, and delete operations on the Bot Details page UI for managing bot lifecycle

2 details in Everything

v18.2.0 Sep 5, 2025 · release notes

Teleport v18.2.0 adds HSM-backed session recording encryption, GCP AlloyDB support, AI summaries, Terraform Access List provisioning, and Intune device sync.

└──▷ GET THIS VERSION

$ git clone --branch v18.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.2.0

Added auth_server.session_recording_config.enabled: yes in Teleport file configuration to enable static encryption of session recordings via HSMs
Added dynamic resource configuration via session_recording_config with spec.encryption.enabled: yes for runtime HSM-backed recording encryption
Added AI-generated summaries for SSH, Kubernetes, and database sessions in the web UI for Identity Security users
Added support for provisioning Access Lists and their members (including nested lists) via Terraform
Added hosted plugin for Microsoft Intune to synchronize trusted devices into Teleport Device Trust

+8 more show less

Added MySQL database client REPL directly in the Teleport web UI terminal interface
Added database access support for GCP AlloyDB instances
Added user_agent field to MySQL database session start audit events
Added configuration of a default namespace for kubeconfig files generated by tbot's kubernetes/v2 service
Added enhanced RBAC rules for session recording access referencing creator’s roles, traits, and resource properties
Added support to configure SCIM Plugin with OIDC or Github Teleport Connectors
Added health check metrics for healthy, unhealthy, and unknown states for database monitoring
Added SSH SELinux module management capability in teleport-update

13 details in Everything

└──▷ BREAKING ON UPGRADE

!Access List review notification check has been removed from the tsh login/status flow, changing the pre-login assessment state for users with pending access list reviews.

v17.7.3 Sep 3, 2025 · release notes

tbot Kubernetes Secret destination now supports specifying a namespace; new oidc Kubernetes joining mode for delegated auth providers.

└──▷ GET THIS VERSION

$ git clone --branch v17.7.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.3

tbot Kubernetes Secret destinations can now specify a custom namespace via the namespace field in the secret configuration
Added oidc joining mode for Kubernetes delegated joining to support providers with public OIDC endpoints (e.g., EKS, AKS, GKE)
Support setting "*" in role kubernetes_users to match all users

3 details in Everything

v16.5.15 Sep 2, 2025 · release notes

Teleport v16.5.15 adds tctl top prometheus metrics view and Helm chart tbot credential support for event plugins.

└──▷ GET THIS VERSION

$ git clone --branch v16.5.15 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.15

└──▷ TRY IT

Override the default client-side gRPC message size limit for large responses.

$ export TELEPORT_UNSTABLE_GRPC_RECV_SIZE=1048576

Helm charts for teleport-plugin-discord, teleport-plugin-email, teleport-plugin-jira, teleport-plugin-mattermost, teleport-plugin-msteams, teleport-plugin-pagerduty, and teleport-plugin-event-handler now support obtaining plugin credentials using tbot.
Added TELEPORT_UNSTABLE_GRPC_RECV_SIZE environment variable to overwrite the client-side maximum gRPC message size.
Enabled Azure joining with VMSS for node registrations.
Windows desktop LDAP discovery now auto-populates the resource's description field.

4 details in Everything

v18.1.8 Aug 29, 2025 · release notes

Support for wildcard * in Kubernetes role kubernetes_users and Helm chart support for tbot plugin credentials

└──▷ GET THIS VERSION

$ git clone --branch v18.1.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.1.8

Allows setting * in role kubernetes_users to grant access to all users instead of listing them individually.
Helm charts for teleport-plugin-discord, teleport-plugin-email, teleport-plugin-jira, teleport-plugin-mattermost, teleport-plugin-msteams, teleport-plugin-pagerduty, and teleport-plugin-event-handler now support obtaining plugin credentials using tbot.

2 details in Everything

v18.1.7 Aug 28, 2025 · release notes

tbot can now manage Argo CD clusters and specifies Kubernetes Secret namespace; OIDC connector gains separate request_object_mode

└──▷ GET THIS VERSION

$ git clone --branch v18.1.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.1.7

└──▷ TRY IT

Re-enable MySQL health checks that are disabled by default in this release.

$ export TELEPORT_ENABLE_MYSQL_DB_HEALTH_CHECKS=1

tbot kubernetes/argo-cd output service added for MWI to manage Argo CD clusters
Environment variable TELEPORT_ENABLE_MYSQL_DB_HEALTH_CHECKS allows re-enabling MySQL database health checks (disabled by default)
request_object_mode setting enabled for the MFA flow in OIDC connectors

3 details in Everything

v18.1.6 Aug 21, 2025 · release notes

Adds JWT-Secured Authorization to OIDC, Azure VMSS joining, gRPC size env var

└──▷ GET THIS VERSION

$ git clone --branch v18.1.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.1.6

└──▷ TRY IT

Override the default client-side gRPC message size limit for large sessions.

$ export TELEPORT_UNSTABLE_GRPC_RECV_SIZE=50000000

TELEPORT_UNSTABLE_GRPC_RECV_SIZE environment variable allows overwriting client-side max gRPC message size.
Adds JWT-Secured Authorization Requests support to the OIDC Connector.
Enables Azure joining with Virtual Machine Scale Sets (VMSS).

3 details in Everything

v17.7.2 Aug 20, 2025 · release notes

Teleport v17.7.2 adds JWT-Secured Authorization for OIDC, bot device modes, and CLI flags

└──▷ GET THIS VERSION

$ git clone --branch v17.7.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.2

└──▷ HOW TO FIND IT

Increase the client-side gRPC message size limit via an environment variable.

📍export TELEPORT_UNSTABLE_GRPC_RECV_SIZE=10485760

Install the SCIM plugin using an OAuth Bearer token for authentication.

$ tctl plugins install scim --auth=bearer-token:YOUR_TOKEN_HERE

Force output of CSR signing results even when partial failures occur, useful for HSM clusters.

$ tctl workload-identity x509-issuer-overrides sign-csrs --force <csr-file>

Add TELEPORT_UNSTABLE_GRPC_RECV_SIZE env var to overwrite client-side max gRPC message size.
Add support for JWT-Secured Authorization Requests to the OIDC Connector.
Device Trust: added required-for-humans mode to enforce checks for human users while allowing bots on unenrolled devices.
Added the --auth flag to the tctl plugins install scim CLI command to support Bearer token and OAuth authentication methods.
Added --force option to tctl workload-identity x509-issuer-overrides sign-csrs to display output from partial failures.

5 details in Everything

v18.1.5 Aug 19, 2025 · release notes

New CockroachDB web/access support, tctl plugins install scim auth flag, Device Trust modes, and Kubernetes delegated joining. Adds required-for-humans mode to allow bots to run on unenrolled devices.

└──▷ GET THIS VERSION

$ git clone --branch v18.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.1.5

Adds --auth flag to tctl plugins install scim CLI command to support Bearer token and OAuth authentication methods
Enroll new Kubernetes agents in Managed Updates
Adds TeleportDatabaseV3 support to the Teleport Kubernetes Operator
Adds TeleportAppV3 support to the Teleport Kubernetes Operator
Allow the use of ResourceGroupsTaggingApi for KMS Key deletion

+8 more show less

Tctl top can now display raw prometheus metrics
Enable resource label conditions for notification routing rules
Device Trust: added required-for-humans mode to allow bots to run on unenrolled devices, while enforcing checks for human users
Add new oidc joining mode for Kubernetes delegated joining to support providers that can be configured to provide public OIDC endpoints
Enrich the windows.desktop.session.start audit event with additional certificate metadata
Database MCP server now supports CockroachDB databases
Added support for CockroachDB Web Access and interactive CockroachDB session playback
Teleport event-handler now accepts HTTP Status Code 204 from the recipient

13 details in Everything

└──▷ BREAKING ON UPGRADE

!Windows desktops cannot be connected to via the Web UI; downgrade proxy servers to 18.1.4, use Teleport Connect instead of the web UI to access desktops, or set your preferred keyboard layout (under account settings) to something other than _system_

v18.1.3 Aug 6, 2025 · release notes

Teleport v18.1.3 adds JSONPath query support for arbitrary JSON OIDC claims

└──▷ GET THIS VERSION

$ git clone --branch v18.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.1.3

v18.1.2 Aug 5, 2025 · release notes

Adds Allowed Tools to tsh mcp ls and configurable shutdown delay.

└──▷ GET THIS VERSION

$ git clone --branch v18.1.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.1.2

tsh mcp ls now lists Allowed Tools and warns if none are allowed.
Added configurable delay between receiving a termination signal and shutting down.

2 details in Everything

v17.7.0 Jul 30, 2025 · release notes

Teleport v17.7.0 adds canary update support for Managed Updates v2 via autoupdate_config

└──▷ GET THIS VERSION

$ git clone --branch v17.7.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.7.0

Adds canary_count configuration key to autoupdate_config specs to enable canary updates for agent groups in Teleport Managed Updates v2
Extends audit log events for SPIFFE SVID issuances to include the name/label selector used by the client

2 details in Everything

v16.5.14 Jul 25, 2025 · release notes

Adds --listen flag to tsh proxy db, extends tctl top to local unix sock, and updates pyroscope defaults in Teleport v16.5.14

└──▷ GET THIS VERSION

$ git clone --branch v16.5.14 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.14

└──▷ TRY IT

Bind the database proxy to a specific local interface for easier access or firewall rules

$ tsh proxy db --listen 127.0.0.1:3306 mysql-instance

tctl top now supports the local unix sock debug endpoint
Updates pyroscope's default client timeout and upload rate

2 details in Everything

v18.1.0 Jul 25, 2025 · release notes

Teleport v18.1.0 adds MCP server/DB access, VNet SSH, bound keypair joining, Sailpoint SCIM, and canary Managed Updates.

└──▷ GET THIS VERSION

$ git clone --branch v18.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.1.0

└──▷ USE IT

Enable canary updates for a Managed Updates group so only 5 agents update first before the rest of the group proceeds.

yaml

kind: autoupdate_config
spec:
  agents:
    mode: enabled
    schedules:
      regular:
      - name: dev
        days:
        - Mon
        - Tue
        - Wed
        - Thu
        start_hour: 20
        canary_count: 5
    strategy: halt-on-error

Adds canary_count field to autoupdate_config schedules, enabling canary updates in Managed Updates v2 — Teleport updates a configurable number of agents first (max 5, randomly selected) and confirms health before rolling out to the rest of a group.
Adds --listen flag to tsh proxy db for setting a custom local listener address.
Adds tctl top support for the local Unix socket debug endpoint.
Adds TeleportRoleV8 support to the Teleport Kubernetes Operator.
Adds multi-account support to Teleport discovery bootstrap.

+13 more show less

Audit log events for SPIFFE SVID issuances now include the name/label selector used by the client.
Client tools managed updates now support multi-cluster environments and track each version in the configuration file.
The teleport-distroless container image now disables client tools updates by default; re-enable by unsetting the TELEPORT_TOOLS_VERSION environment variable.
Defines a new access-plugin preset role.
Adds native MCP server access with connection proxying and audit logging support for stdio-based MCP servers.
Adds MCP integration for database access, allowing MCP clients such as Claude Desktop to execute queries in Teleport-protected databases.
Adds VNet native SSH support, enabling any SSH client to connect to Teleport SSH servers with zero configuration and first-class per-session MFA.
Adds identifier-first login flow: the initial login screen shows only a username prompt, then presents applicable SSO connectors after username submission.
Adds bound keypair join method for Machine ID as a more secure alternative to token joining, with automatic self-recovery from expired client certificates.
Adds Sailpoint SCIM provider integration, allowing administrators to synchronize Sailpoint entitlement groups with Teleport access lists.
Improves access requests web UI to make a clearer distinction between just-in-time and long-term access request flows.
Adds enrolment for a generic SCIM integration (Enterprise).
tbot client now discards expired identities during renewal to allow automatic recovery without restarting the process.

18 details in Everything

v17.6.0 Jul 23, 2025 · release notes

Teleport v17.6.0 adds native VNet SSH support and updates tctl/tsh capabilities

└──▷ GET THIS VERSION

$ git clone --branch v17.6.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.6.0

Adds native SSH protocol support to VNet, allowing standard SSH clients to connect with zero configuration and full support for features like per-session MFA.
Enables tctl top to read metrics from the local unix socket debug endpoint.
Extends tsh App Access commands to support Azure CLI (az) version 2.73.0 and newer.
Allows client tools managed updates to operate in multi-cluster environments by tracking versions per cluster in the configuration file.

4 details in Everything

v17.5.5 Jul 21, 2025 · release notes

Teleport v17.5.5 adds sortable bot instances in UI and VNet DNS over IPv4

└──▷ GET THIS VERSION

$ git clone --branch v17.5.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.5.5

└──▷ HOW TO FIND IT

View bots sorted by most recent activity to identify stale or unresponsive bot instances.

📍In the Teleport web UI, navigate to Bot Instances and click the Latest Heartbeat column header to sort.

Adds sorting of Bot instances by latest heartbeat time in the Teleport web UI

1 detail in Everything

v18.0.1 Jul 21, 2025 · release notes

Adds tctl autoupdate agents report command, CRD access requests, and auto-reviews for resource requests.

└──▷ GET THIS VERSION

$ git clone --branch v18.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.0.1

Added support for CRD in access requests.
Enabled automatic reviews of resource requests.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!tbot no longer supports providing a proxy server address via --auth-server or auth_server, use --proxy-server or proxy_server instead.

v18.0.2 Jul 17, 2025 · release notes

Teleport v18.0.2 adds glob-style matching for Spacelift join rules and improves bot health reporting.

└──▷ GET THIS VERSION

$ git clone --branch v18.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.0.2

v17.5.6 Jul 17, 2025 · release notes

Teleport v17.5.6 adds glob-style matching to Spacelift join rules and improves PKINIT compatibility.

└──▷ GET THIS VERSION

$ git clone --branch v17.5.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.5.6

v18.0.0 Jul 4, 2025 · release notes

Teleport v18 adds Identity Activity Center, automatic access request reviews, multi-session MFA, SAML device trust, DB health checks, and Kubernetes CRD support in role v8

└──▷ GET THIS VERSION

$ git clone --branch v18.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v18.0.0

└──▷ USE IT

Execute queries across multiple selected databases with a single MFA challenge using the new multi-session command

shell

tsh db exec --db-server '*' 'SELECT * FROM users'

Update Windows desktop discovery configuration to support multiple discovery configs with custom RDP ports and intervals

config

windows_desktop_service:
  enabled: yes
  discovery_configs:
    - base_dn: '*'
      label_attributes: [ department ]
      rdp_port: 9989
      discovery_interval: 10m

Configure role version 8 to grant access to Kubernetes CRDs with the new api_group field

config

kind: role
metadata:
  name: kube-access-v8
spec:
  allow:
    kubernetes_groups:
    - '{{internal.kubernetes_groups}}'
    kubernetes_labels:
      '*': '*'
    kubernetes_resources:
    - api_group: stable.example.com
      kind: crontabs
      name: '*'
      namespace: '*'
      verbs:
      - '*'
  deny: {}
version: v8

Enable PKCE in OIDC connector configuration to prevent authorization code interception attacks

config

oidc:
  pkce_mode: enabled

Adds Identity Activity Center to expose hidden identity risk by correlating user activity from AWS CloudTrail, GitHub Audit Log API, Okta Audit API, and Teleport Audit Log
Adds automatic access request reviews via Access Monitoring Rules to auto-approve or deny requests without separate plugins
Adds tsh db exec command for multi-session MFA reuse across multiple database connections
Adds RBAC controls using app_labels for SAML applications and enforces device trust on SAML IdP sessions
Adds automatic db_server health checks that report status in the UI and prioritize healthy services for routing

+9 more show less

Adds support for Kubernetes Custom Resource Definitions (CRDs) in role version 8, including the new api_group field in kubernetes_resources
Adds pkce_mode: enabled option to OIDC connector configurations for Proof Key for Code Exchange support
Changes Windows desktop discovery configuration from discovery to discovery_configs to allow multiple separate discovery configurations with custom RDP ports and intervals
Removes manual TLS cipher suite configuration, specifically dropping support for tls-rsa-with-aes-128-cbc-sha, tls-rsa-with-aes-256-cbc-sha, tls-rsa-with-aes-128-cbc-sha256, tls-rsa-with-aes-128-gcm-sha256, tls-rsa-with-aes-256-gcm-sha384, tls-ecdhe-ecdsa-with-aes-128-cbc-sha256, and tls-ecdhe-rsa-with-aes-128-cbc-sha256
Changes Terraform provider role defaults to leave unset booleans empty instead of defaulting to false, allowing Teleport to pick UI/operator defaults
Removes custom service endpoint support for tsh aws and tsh proxy aws, requiring use as HTTPS_PROXY servers instead
Blocks TOTP as a second factor for per-session MFA in tsh (TOTP remains valid for initial login)
Requires Linux kernel version 3.2 or later for Teleport operations
Removes legacy ALPN connection upgrade mode, including the TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE environment variable

14 details in Everything

└──▷ BREAKING ON UPGRADE

!Manual TLS cipher suite configuration is no longer supported; configurations listing tls-rsa-with-aes-128-cbc-sha, tls-rsa-with-aes-256-cbc-sha, tls-rsa-with-aes-128-cbc-sha256, tls-rsa-with-aes-128-gcm-sha256, tls-rsa-with-aes-256-gcm-sha384, tls-ecdhe-ecdsa-with-aes-128-cbc-sha256, or tls-ecdhe-rsa-with-aes-128-cbc-sha256 will fail or be ignored
!Terraform provider role defaults change from explicit false to null for unset booleans, which may alter default behavior for options like cert_format, create_host_user, desktop_clipboard, desktop_directory_sharing, and ssh_file_copy
!tsh aws and tsh proxy aws commands no longer support custom service endpoints; users must use HTTPS_PROXY environment variable instead
!tsh rejects TOTP as a second factor for per-session MFA, restricting it to initial login only
!Linux systems with kernel version lower than 3.2 are no longer supported
!Legacy ALPN upgrade mode and the TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE environment variable are removed

v15.5.4 Jul 3, 2025 · release notes

Adds --is-up-to-date flag to teleport-update status for scriptable update checks

└──▷ GET THIS VERSION

$ git clone --branch v15.5.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.5.4

└──▷ USE IT

Check if the node is up-to-date and skip subsequent update steps if it is, enabling idempotent automation.

shell

teleport-update status --is-up-to-date

v16.5.13 Jul 3, 2025 · release notes

Teleport v16.5.13 adds workload identity label templating and tbot O_CLOEXEC enforcement

└──▷ GET THIS VERSION

$ git clone --branch v16.5.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.13

└──▷ USE IT

Check if teleport-update has the latest version and script CI/CD pipelines to exit 0 immediately if no update is needed.

shell

teleport-update status --is-up-to-date && echo 'Up to date'

workload_identity_labels Role resource field now supports trait role templating.
tbot client now ensures the O_CLOEXEC flag is used when opening files on Linux hosts.
Added the --is-up-to-date flag to teleport-update status to change the return code based on the update status.

3 details in Everything

v17.5.4 Jul 2, 2025 · release notes

tbot now allows overriding service names in logs and /readyz endpoint for better observability

└──▷ GET THIS VERSION

$ git clone --branch v17.5.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.5.4

/readyz endpoint behavior updated to accurately represent tbot health
Adds ability to override service names used in tbot logs and /readyz endpoint

2 details in Everything

v17.5.3 Jul 1, 2025 · release notes

Adds tsh db exec multi-database command, SSO MFA for desktop access, and Oracle SCAN support.

└──▷ GET THIS VERSION

$ git clone --branch v17.5.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.5.3

└──▷ USE IT

Check if the teleport-update daemon is current, returning 0 if it is and non-zero otherwise for CI/CD gating.

shell

teleport-update status --is-up-to-date && echo 'Up to date' || echo 'Update needed'

Execute a command across multiple target databases with a single MFA prompt.

shell

tsh db exec --db-name 'mydb' --user 'admin' -- 'ls -la /var/log'

Configure tbot proxy address using the new flag.

shell

tbot start --proxy-server proxy.example.com

teleport-update status --is-up-to-date flag added to control the return code based on update status
tbot CLI now uses --proxy-server or proxy_server instead of the removed --auth-server / auth_server flags for proxy configuration
Added support for executing commands across multiple target databases via tsh db exec with per-session MFA batching
Added SSO MFA support for desktop access
Database protocols using Kerberos (SQL Server, Oracle) can now fetch user SID for Full Enforcement mapping

+3 more show less

Added support for Oracle SCAN (Single Client Access Name)
Added support for AWS KMS multi-region keys with key replication
Machine and Workload Identity: tbot will keep retrying if the auth server is unavailable on startup, instead of exiting immediately

8 details in Everything

└──▷ BREAKING ON UPGRADE

!tbot no longer supports providing a proxy server address via --auth-server or auth_server, use --proxy-server or proxy_server instead.

advisory CVE-2025-49825 Jun 16, 2025 · issue 128

CVE-2025-49825: Remote authentication bypass (CVSS 9.8, affects <17.5.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

v17.5.1 Jun 5, 2025 · release notes

Adds Azure DevOps bot joining method, desktop latency detector in UI, and SAML http-post binding support

└──▷ GET THIS VERSION

$ git clone --branch v17.5.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.5.1

└──▷ USE IT

Configure a bot in Azure DevOps to join your cluster automatically without manual token management.

yaml

# In your Teleport Cluster configuration or plugin spec:
kind: join
method: azure_devops

Use the http-post binding for SAML SSO when your IdP requires it for enhanced security.

📍# In the Teleport web UI under Zero Trust Access / Auth Connectors › Edit Connector: preferred_request_binding: http-post

Introduces the azure_devops join method for secretless authentication of bots in Azure DevOps pipelines.
Adds latency measurement displays in the Teleport Connect web UI during remote desktop sessions to monitor user-to-proxy and proxy-to-host lag.
Enables SAML http-post binding via the new preferred_request_binding: http-post field in SSO connector configurations.
Exposes Teleport service cache health metrics via Prometheus for monitoring infrastructure reliability.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!None

v14.4.0 May 23, 2025 · release notes

Teleport v14.4.0 introduces teleport-update binary and autoupdate_config resource for agent auto-updates.

└──▷ GET THIS VERSION

$ git clone --branch v14.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.4.0

└──▷ TRY IT

Manually enroll an existing agent to the automatic update system.

$ teleport-update enable

Introduces the teleport-update binary to manage automatic Teleport agent updates
Adds autoupdate_config and autoupdate_version resources to configure update schedules and desired versions
Enables enrollment of existing agents via the teleport-update enable command
Moves Teleport binaries from /usr/local/bin to /opt/teleport in DEB/RPM packages

4 details in Everything

v16.5.10 May 22, 2025 · release notes

Teleport v16.5.10 exposes service cache health via Prometheus metrics and hardens Hardware Key Agent validation.

└──▷ GET THIS VERSION

$ git clone --branch v16.5.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.10

Hardware Key Agent now validates known keys by checking active or expired login session

1 detail in Everything

v15.5.1 May 22, 2025 · release notes

Adds skip.authors and include.labels to .hacktron/config.yaml to control which pull requests get scanned; adds FIPS support for teleport-update

└──▷ GET THIS VERSION

$ git clone --branch v15.5.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.5.1

Expose the Teleport service cache health via Prometheus metrics.
Added full support for FIPS agent installations to teleport-update.

2 details in Everything

v16.5.9 May 15, 2025 · release notes

Teleport v16.5.9 adds binary_path/binary_hash to Unix workload attestor and full FIPS agent install support in Teleport-update.

└──▷ GET THIS VERSION

$ git clone --branch v16.5.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.9

Adds binary_path and binary_hash fields to the attributes returned by the Unix workload attestor for Workload ID
Enables Teleport-update to fully support FIPS agent installations
Includes templating and rule evaluation attributes in the audit log event for workload identity credential issuance

3 details in Everything

v16.5.6 Apr 30, 2025 · release notes

Adds a Hardware Key Agent to Teleport Connect with configurable pin caching

└──▷ GET THIS VERSION

$ git clone --branch v16.5.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.6

cap.hardware_key.pin_cache_ttl cluster option lets Teleport Connect cache hardware key PINs between client calls
Added a Hardware Key Agent in Teleport Connect that handles prompts for other clients (tsh, tctl)
Increased the email access plugin timeout for sending e-mails from 5 to 15 seconds

3 details in Everything

v17.4.7 Apr 29, 2025 · release notes

Adds Hardware Key Agent to Teleport Connect and cap.hardware_key.pin_cache_ttl cluster option for PIN caching

└──▷ GET THIS VERSION

$ git clone --branch v17.4.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.4.7

└──▷ HOW TO FIND IT

Enable Hardware Key Agent in Teleport Connect settings to allow it to handle prompts for tsh/tctl.

📍Navigate to Teleport Connect Settings › Hardware Keys and enable the agent, then verify cap.hardware_key.pin_cache_ttl is set.

Adds Hardware Key Agent to Teleport Connect to handle prompts on behalf of other Teleport Clients like tsh and tctl
Adds cluster option cap.hardware_key.pin_cache_ttl to control PIN caching duration between client calls

2 details in Everything

v15.5.0 Apr 29, 2025 · release notes

Teleport v15.5 introduces automatic agent updates via teleport-update binary and new CRDs, plus readiness tuning for Helm

└──▷ GET THIS VERSION

$ git clone --branch v15.5.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.5.0

└──▷ USE IT

Configure a cluster to automatically update agents every Sunday at 2 AM.

yaml

api
import teleport
autoupdate = teleport.autoupdate_config(
    name='default',
    spec=teleport.AutoupdateSpec(schedule='0 2 * * 0')
)
print(autoupdate.to_yaml())

Adjust Helm values to prevent pods from failing readiness checks during transient backend outages.

$ helm install teleport teleport/teleport-cluster --set auth.readiness.initialDelaySeconds=600 --set proxy.readiness.initialDelaySeconds=600

Introduces teleport-update binary for package-manager-agnostic agent updates.
Adds autoupdate_config custom resource to define agent update schedule.
Adds autoupdate_version custom resource to specify desired agent version.
Enables enrollment of existing agents with teleport-update enable command.
Allows tuning pod readiness probes in teleport-cluster Helm chart to keep pods ready during degraded backend states.

+1 more show less

Moves DEB/RPM binary installation path to /opt/teleport instead of /usr/local/bin.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!DEB and RPM packages place binaries in /opt/teleport instead of /usr/local/bin (symlinks preserved).

v17.4.6 Apr 23, 2025 · release notes

Tbot gains env var override for GitLab ID Token and UI adds role descriptions

└──▷ GET THIS VERSION

$ git clone --branch v17.4.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.4.6

└──▷ HOW TO FIND IT

View role descriptions directly in the Teleport Web UI roles table.

📍In the Web UI, navigate to Access › Roles and check the Description column

tbot now supports a non-standard environment variable to source the ID Token for GitLab joining
Web UI roles table now displays role descriptions

2 details in Everything

v17.4.5 Apr 18, 2025 · release notes

Teleport v17.4.5 adds autoupdate_config/autoupdate_version to Terraform provider, DB role selection in WebUI, SPIFFE X509-SVIDs, and SAML preset for Entra External ID

└──▷ GET THIS VERSION

$ git clone --branch v17.4.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.4.5

└──▷ TRY IT

Create a bot with an extended certificate lifetime for long-lived machine identity workflows.

$ tctl bots add my-bot --max-session-ttl=168h

Adds autoupdate_config and autoupdate_version attributes to the Teleport Terraform Provider teleport_autoupdate_config_v2 resource.
Enables users to select database roles when connecting to PostgreSQL databases via the Teleport WebUI.
Adds a new SAML IdP service provider preset for Microsoft Entra External ID.
Increases the maximum bot certificate TTL to 7 days, controlled by the --max-session-ttl flag in tctl bots add.

4 details in Everything

v16.5.2 Apr 15, 2025 · release notes

Teleport v16.5.2 adds container image digest capture to Workload ID and a new proxy_protocol_allow_downgrade config key

└──▷ GET THIS VERSION

$ git clone --branch v16.5.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.2

Adds container image digest capture to Kubernetes, Podman, and Docker attestors in Workload ID
Adds proxy_protocol_allow_downgrade field to the proxy_service configuration for IPv6-to-IPv4 single-stack environments

2 details in Everything

v17.4.4 Apr 15, 2025 · release notes

Teleport v17.4.4 adds Oracle join method for Workload Identity, proxy_protocol_allow_downgrade config, and WorkloadIdentity resource management in K8s Operator

└──▷ GET THIS VERSION

$ git clone --branch v17.4.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.4.4

Adds oracle join method to Workload Identity templating and rule evaluation
New proxy_protocol_allow_downgrade field in the proxy_service configuration section
Adds Kubernetes resources to manage WorkloadIdentity via the Teleport Kubernetes Operator
Workload ID Kubernetes, Podman, and Docker attestors now capture container image digest
Added support for specifying a WorkloadIdentity-specific maximum TTL

5 details in Everything

v15.4.31 Apr 9, 2025 · release notes

Teleport v15.4.31 adds --join-method flag to teleport configure and DynamoDB Streams FIPS support.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.31 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.31

└──▷ USE IT

Explicitly set the join method (e.g., token, aws-auth) during initial cluster configuration.

shell

teleport configure --join-method=token

Adds --join-method flag to the teleport configure command to control cluster join behavior
Add support for using DynamoDB Streams FIPS endpoints in the event stream backend

2 details in Everything

v16.5.1 Apr 9, 2025 · release notes

Adds custom claims to JWT-SVIDs for Workload ID and annotation support for Kubernetes app discovery.

└──▷ GET THIS VERSION

$ git clone --branch v16.5.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.1

Kubernetes app discovery now supports an additional annotation for apps that are served on a sub-path of an HTTP service

1 detail in Everything

v17.4.3 Apr 9, 2025 · release notes

Teleport v17.4.3 adds Bot resource management in Kubernetes Operator and Okta Bidirectional Sync

└──▷ GET THIS VERSION

$ git clone --branch v17.4.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.4.3

Support for managing the Bot resource in the Teleport Kubernetes Operator.
Kubernetes app discovery now supports an additional annotation for apps served on a sub-path of an HTTP service.
Bidirectional Sync option added to the Okta Integration, allowing for a read-only integration where changes are only synced from Okta to Teleport.

3 details in Everything

v17.4.2 Apr 2, 2025 · release notes

Workload ID now supports adding custom claims to JWT-SVIDs

└──▷ GET THIS VERSION

$ git clone --branch v17.4.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.4.2

v16.5.0 Mar 28, 2025 · release notes

Teleport v16.5.0 introduces automatic agent updates via autoupdate_config resources and a new teleport-update binary

└──▷ GET THIS VERSION

$ git clone --branch v16.5.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.5.0

Adds autoupdate_config and autoupdate_version resources to configure the agent update schedule and desired version
Introduces the teleport-update binary for performing automatic, package-manager-agnostic updates
Adds the teleport-update enable subcommand to enroll existing agents in the new update system
Adds the static_jwks field to the GitLab join method configuration
Adds support for attesting Systemd services via Workload ID

+1 more show less

Enables joining Kubernetes sessions in the web UI

6 details in Everything

└──▷ BREAKING ON UPGRADE

!DEB and RPM packages install binaries to /opt/teleport instead of /usr/local/bin.

v17.4.0 Mar 28, 2025 · release notes

Teleport v17.4.0 adds Oracle RDS access, Windows dual-host support, and workload-identity-aws-ra service

└──▷ GET THIS VERSION

$ git clone --branch v17.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.4.0

Database access for Oracle RDS with Kerberos authentication
AWS integration status dashboard and user tasks view in the web UI to highlight remediation steps
Support for registering a single Windows host as both domain-joined and standalone machine
Joined Kubernetes sessions from the web UI
static_jwks field in the GitLab join method configuration

+6 more show less

New workload-identity-aws-ra service for generating AWS credentials via Roles Anywhere in tbot
Support for specifying a second factor list in the teleport-cluster Helm chart
Support for topologySpreadConstraints in the teleport-cluster Helm chart
SendEnv OpenSSH option support in tsh
Support for DynamoDB Streams FIPS endpoints
Workload ID: support for attesting Systemd services

11 details in Everything

v17.3.4 Mar 20, 2025 · release notes

Adds --join-method flag to teleport configure; adds Docker/Podman attestation for Workload ID

└──▷ GET THIS VERSION

$ git clone --branch v17.3.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.3.4

Adds --join-method flag to the teleport configure command to control cluster joining behavior.
Adds support for attesting Docker workloads in Workload Identity.
Adds support for attesting Podman workloads in Workload Identity.

3 details in Everything

v16.4.18 Mar 18, 2025 · release notes

Teleport v16.4.18 adds Podman workload attestation, a --join-method flag for teleport configure, and configurable PKCS#11 max connections.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.18

└──▷ TRY IT

Specify how Teleport should join a cluster during the initial configuration process.

$ teleport configure --join-method=token

Workload ID: support for attesting Podman workloads.
Allow specifying the maximum number of PKCS#11 HSM connections.

2 details in Everything

v16.4.17 Mar 6, 2025 · release notes

Adds TPL support in Workload Identity templates, JSON output for /webapi/auth/export API, and allow_reissue tbot field.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.17

└──▷ TRY IT

Fetch the public certificate from the Teleport cluster in JSON format for automated consumption.

$ curl -k https://<cluster_address>/webapi/auth/export | jq .

Workload Identity templates now support Teleport Predicate Language (TPL) for rules and templates
tbot identity output now includes the allow_reissue property for compatibility with tsh based reissuance
Added JSON response support to the /webapi/auth/export public certificate API endpoint

3 details in Everything

└──▷ BREAKING ON UPGRADE

!tctl can no longer load the default configuration file on Windows.

v15.4.30 Mar 6, 2025 · release notes

Teleport v15.4.30 adds Kubernetes annotation-based public address support for discovered apps and JSON output to /webapi/auth/export.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.30 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.30

Adds JSON response format to the GET /webapi/auth/export public certificate API endpoint (also supports existing PEM format)

1 detail in Everything

v17.3.2 Mar 5, 2025 · release notes

Teleport v17.3.2 adds Prometheus metrics for Machine ID renewal and app discovery via Kubernetes annotations

└──▷ GET THIS VERSION

$ git clone --branch v17.3.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.3.2

Adds version compatibility warnings to Teleport Connect when logging in to a cluster
Supports setting the public address for discovered apps based on Kubernetes annotations
Machine ID adds new Prometheus metrics to track success and failure of renewal loops
Allows teleport-update to be used in shells that set a restrictive umask

4 details in Everything

v17.3.1 Mar 3, 2025 · release notes

Adds Workload ID Predicate Language support and changes default TLS routing upgrade mode.

└──▷ GET THIS VERSION

$ git clone --branch v17.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.3.1

Workload Identity templates and rules now accept Teleport Predicate Language expressions for matching workloads.

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!Default TLS routing connection upgrade mode changes from supporting ALPN fallback to requiring WebSocket headers; the TELEPORT_TLS_ROUTING_CONN_UPGRADE_MODE environment variable must be set to legacy if ALPN is required.

v17.3.0 Feb 28, 2025 · release notes

Adds autoupdate agent resource types and teleport-update binary for automatic agent version control

└──▷ GET THIS VERSION

$ git clone --branch v17.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.3.0

└──▷ USE IT

Enable automatic updates on an existing agent via the CLI

shell

teleport-update enable

Introduces autoupdate_config and autoupdate_version CRD resources to define desired Teleport versions for agents
Ships the new teleport-update binary to handle opt-in, package-manager-agnostic automatic updates for Teleport agents
Enables Oracle Cloud Infrastructure join method without static tokens via the Oracle agent join plugin
Provides stable UIDs when creating host users across the entire Teleport cluster
Makes VNet available on Windows for TCP application access within the same network

+7 more show less

Supports IAM authentication and hybrid identity setups for AWS Identity Center integration
Allows updating Okta integration settings (sync configuration, group filters) without recreating the integration
Changes readiness probe semantics: Auth Service checks backend storage connectivity and Proxy Service checks Auth API connectivity
Adds tctl edit support for Identity Center plugin resources
Adds Oracle join method to web UI provision token editor
Adds auto-importing of Oracle Cloud tags for agents
Adds support for X509 revocations in Workload Identity

12 details in Everything

└──▷ BREAKING ON UPGRADE

!The Okta plugin must be reinstalled if the cluster is downgraded after upgrading to v17.3 with the new enrollment flow

v17.2.9 Feb 25, 2025 · release notes

Adds tbot env var config support, tctl Identity Center installer, and JSON export to /webapi/auth/export

└──▷ GET THIS VERSION

$ git clone --branch v17.2.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.2.9

└──▷ USE IT

Request public certificates in JSON format via the Teleport API for programmatic consumption.

shell

curl -H 'Accept: application/json' https://teleport.example.com:443/webapi/auth/export

Adds TBOT_* environment variable support for configuring tbot at runtime
Adds new tctl installer command/plugin for AWS IAM Identity Center integration
Enables application/json response format on the /webapi/auth/export public certificate API endpoint
Adds filter drop-downs and pinning controls to the Enroll a New Resource page in the web UI

4 details in Everything

v17.2.8 Feb 20, 2025 · release notes

Tbot gains credential_ttl override and allow_reissue output support; env var for non-FIPS AWS endpoints

└──▷ GET THIS VERSION

$ git clone --branch v17.2.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.2.8

└──▷ USE IT

Connect to non-FIPS AWS endpoints when running a FIPS-compliant Teleport binary

shell

TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes teleport auth start

Configure tbot to output identities that support reissuance via tsh

📍# In tbot config.yml for the relevant identity output: outputs: - type: file path: /etc/tbot/creds allow_reissue: true

Override default TTL and renewal intervals for tbot credentials

📍# In tbot config.yml: # credential_ttl: 24h # renewal_interval: 12h

Adds TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes environment variable to allow Teleport FIPS binaries to connect to non-FIPS AWS endpoints for IAM and STS
Introduces allow_reissue property in the tbot identity output to enable compatibility with tsh based reissuance workflows
Adds support for overriding credential_ttl and renewal_interval on most tbot outputs and services

3 details in Everything

└──▷ BREAKING ON UPGRADE

!tctl no longer loads the default configuration file on Windows

v15.4.29 Feb 15, 2025 · release notes

Adds TELEPORT_UNSTABLE_DISABLE_AWS_FIPS env var, debug socket control via debug_service.enabled, continuous Pyroscope profiling, and audit stats in tctl top.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.29 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.29

└──▷ USE IT

Disable FIPS restrictions for AWS services when running a Teleport FIPS build in a non-FIPS compliant environment.

shell

export TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes
start-teleport

Restrict the debug socket to metrics only, preventing raw debugger access while keeping monitoring endpoints available.

yaml

debug_service:
  enabled: true
# Only metrics are exposed; debugging requires separate enablement if supported by version

View audit log statistics like event counts and duration to monitor cluster activity in the terminal.

shell

tctl top stats

Added escape hatch environment variable TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes to allow non-FIPS AWS endpoints on FIPS binaries
Added new debug_service.enabled config field to control availability of debug and metrics endpoints via the debug.sock UNIX socket
Added support for continuous profile collection with Pyroscope
Added Audit Log statistics to the tctl top command output

4 details in Everything

v17.2.7 Feb 14, 2025 · release notes

Teleport v17.2.7 adds workload_identity resource, tsh workload-identity issue-x509 command, and Azure Discovery Service integration.

└──▷ GET THIS VERSION

$ git clone --branch v17.2.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.2.7

└──▷ USE IT

Configure a new Workload Identity resource definition.

yaml

workload_identity:
  kind: workload_identity
  version: v2
  metadata:
    name: my-workload
  spec:
    claims_to_roles:
      - claim: email
        value: "*@example.com"
        roles: [editor]

Issue x509 credentials using the new subcommand.

shell

tsh workload-identity issue-x509 --id <id> --type x509

Bypass FIPS restrictions for AWS endpoints when using a FIPS binary.

shell

export TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes

Introduces tsh workload-identity issue-x509 as the replacement to tsh svid issue
Backports new Azure integration functionality allowing the Discovery Service to fetch Azure resources and send them to the Access Graph
Adds Audit Log statistics to tctl top
Adds support for caching Microsoft Remote Desktop Services licenses
Adds an escape hatch environment variable TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes to allow non-FIPS AWS endpoints on FIPS binaries

+4 more show less

Adds ability to disable path-style S3 access for third-party endpoints
Adds support for multiple active CAs in the /auth/export endpoint
Adds support for continuous profile collection with Pyroscope
Adds securityContext value to the tbot Helm chart

9 details in Everything

v16.4.16 Feb 14, 2025 · release notes

Teleport v16.4.16 adds tsh workload-identity issue-x509, workload_identity resource, and more granular SSH port forwarding audit logs

└──▷ GET THIS VERSION

$ git clone --branch v16.4.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.16

└──▷ USE IT

Use the new workload identity command to issue X509 certificates for workloads.

shell

tsh workload-identity issue-x509 <workload-id>

Added ability to disable path-style S3 access for third-party endpoints
Added Audit Log statistics to tctl top
Introduced the new workload_identity resource for configuring Teleport Workload Identity
Added support for multiple active CAs in /auth/export endpoint
Added support for multiple active CAs in tctl auth export

+6 more show less

Added securityContext value to the tbot Helm chart
Include the format and session_type fields for the session.recording.access audit event
Teleport agents always create the debug.sock UNIX socket. The configuration field debug_service.enabled now controls if the debug and metrics endpoints are available via the UNIX socket
Added an escape hatch to allow non-FIPS AWS endpoints on FIPS binaries (TELEPORT_UNSTABLE_DISABLE_AWS_FIPS=yes)
Introduced tsh workload-identity issue-x509 as the replacement to tsh svid issue and which is compatible with the new WorkloadIdentity resource
Added more granular audit logging surrounding SSH port forwarding

11 details in Everything

v17.2.1 Jan 23, 2025 · release notes

Teleport v17.2.1 adds wildcard-workload-identity-issuer role preset and multiple active CA export support

└──▷ GET THIS VERSION

$ git clone --branch v17.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.2.1

tctl auth export now supports exporting certificates for multiple active CAs.
Role presets now include default values for github_permissions and the git_server resource kind, with github_permissions supporting traits.

2 details in Everything

v17.2.0 Jan 22, 2025 · release notes

Teleport v17.2.0 adds native GitHub access, per-session MFA via IdP, and Toad client support.

└──▷ GET THIS VERSION

$ git clone --branch v17.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.2.0

Adds native GitHub access with RBAC and audit logging
Enables per-session MFA checks using an external identity provider
Adds Oracle Toad GUI client support for database access

3 details in Everything

v17.1.6 Jan 14, 2025 · release notes

Trusted clusters now supported in Kubernetes operator

└──▷ GET THIS VERSION

$ git clone --branch v17.1.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.1.6

v16.4.13 Jan 11, 2025 · release notes

Adds --labels flag to tctl tokens ls for filtering token list output.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.13

└──▷ USE IT

Filter token list output by specific labels directly from the CLI.

shell

tctl tokens ls --labels env=prod,role=admin

v17.1.5 Jan 10, 2025 · release notes

Teleport v17.1.5 adds multi-port TCP support to tsh proxy app, user_agent to audit events, and improved Oracle database agent compatibility.

└──▷ GET THIS VERSION

$ git clone --branch v17.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.1.5

Adds multi-port TCP application proxy support via the --remote-ports flag in tsh proxy app
Includes the user_agent field in db.session.start audit events for database session auditing

2 details in Everything

v17.1.3 Jan 2, 2025 · release notes

Adds --labels flag to tctl tokens ls for filtering token listings by labels.

└──▷ GET THIS VERSION

$ git clone --branch v17.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.1.3

└──▷ USE IT

Filter token listings to only show those with a specific label key-value pair.

shell

tctl tokens ls --labels environment=production

v17.1.1 Dec 20, 2024 · release notes

Teleport v17.1.1 adds PostgreSQL Web UI access, granular SSH port forwarding controls, and VNet multi-port support.

└──▷ GET THIS VERSION

$ git clone --branch v17.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.1.1

└──▷ USE IT

Allow remote port forwarding for admins while denying local port forwarding using the new granular role option.

yaml

ssh_port_forwarding:
  allow_local: false
  allow_remote: true

Connect to a PostgreSQL database instance managed by Teleport directly in the browser.

📍Steps: In the Teleport web UI, navigate to the cluster's Resources › Databases view and select the target PostgreSQL database. Click Connect and use the embedded psql-style interface to run queries.

Adds ssh_port_forwarding role option to control local and remote port forwarding independently
Adds PostgreSQL database access directly from the Teleport web UI with psql-style interface
Adds Hosted email plugin (Mailgun or generic SMTP) setup via Web UI for Access Request notifications
Adds AWS Identity Center integration to Access Requests, allowing requests for permission set access
Adds Graphical Role Editor in the Teleport web UI as an alternative to raw YAML editing

+1 more show less

Exposes /.well-known/jwks-okta public endpoint for Okta API services type App

6 details in Everything

v15.4.24 Dec 12, 2024 · release notes

Client tools auto-updates now controlled by cluster configuration.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.24 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.24

v16.4.11 Dec 11, 2024 · release notes

Teleport v16.4.11 adds a license updater service and lets users view enrolled devices via the Account page.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.11

Added a new license-updater service to automatically refresh licensing information in Teleport deployments
Users can now view their enrolled devices list directly on the Account page in Teleport Connect

2 details in Everything

v17.0.5 Dec 11, 2024 · release notes

Teleport v17.0.5 adds interactive mode to tctl auth rotate and improves Web UI dialogs.

└──▷ GET THIS VERSION

$ git clone --branch v17.0.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.0.5

└──▷ TRY IT

Rotate auth server certificates interactively using the new tctl command mode.

$ tctl auth rotate --interactive

tctl auth rotate now supports interactive mode for easier certificate rotation.
Teleport Connect's web session authorization dialog is now a dedicated tab with improved re-login handling.

2 details in Everything

v15.4.23 Dec 6, 2024 · release notes

Adds Kubernetes audit log SSH/K8s info, teleport-cluster operator resource labels, and Azure multi-subscription joining.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.23 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.23

Adds SSH or Kubernetes information to the start session audit log list.
Adds ability to configure resource labels in teleport-cluster's operator sub-chart.
Allows Azure VMs to join from a different subscription than their managed identity.
Respects client_idle_timeout config for long-running kube exec/port-forward sessions.

4 details in Everything

v17.0.4 Dec 6, 2024 · release notes

Teleport v17.0.4 adds SSH and Kubernetes info to audit log list for start session events.

└──▷ GET THIS VERSION

$ git clone --branch v17.0.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.0.4

v16.4.10 Dec 6, 2024 · release notes

Teleport v16.4.10 adds hardware key support in Connect and auto-update control for client tools

└──▷ GET THIS VERSION

$ git clone --branch v16.4.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.10

Adds hardware_keys support in Teleport Connect for FIDO2/WebAuthn authentication.
Controls {tctl,tsh} client tool auto-updates via cluster configuration.

2 details in Everything

v17.0.3 Dec 4, 2024 · release notes

Teleport v17.0.3 adds searchable session playback, in-cluster join audience flexibility, and new enterprise controls for device lists and access request reasons.

└──▷ GET THIS VERSION

$ git clone --branch v17.0.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.0.3

Session recording playback in the web UI is now searchable
Add ability to configure resource labels in teleport-cluster's operator sub-chart
Kubernetes in-cluster joining now also accepts tokens whose audience is the Teleport cluster name (before it only allowed the default Kubernetes audience). Kubernetes JWKS joining is unchanged and still requires tokens with the cluster name in the audience.
Users can now see a list of their enrolled devices on their Account page
Added support for requiring reason for Access Requests (with a new role.spec.allow.request.reason.mode setting)

5 details in Everything

v16.4.9 Dec 3, 2024 · release notes

Adds resource labels to teleport-cluster operator sub-chart, session search in Web UI/Connect, and Bitbucket Pipelines support for Machine ID

└──▷ GET THIS VERSION

$ git clone --branch v16.4.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.9

Add ability to configure resource labels in teleport-cluster's operator sub-chart.
Session recording playback in the web UI is now searchable.
You can now search text within ssh sessions in the Web UI and Teleport Connect.
Support delegated joining for Bitbucket Pipelines in Machine ID.

4 details in Everything

v14.3.34 Dec 2, 2024 · release notes

Adds -- delimiter support to tsh ssh and allows overriding Teleport license secret name in the Helm chart.

└──▷ GET THIS VERSION

$ git clone --branch v14.3.34 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.34

└──▷ USE IT

Execute a command on a remote host using tsh ssh with the -- delimiter to avoid ambiguity.

shell

tsh ssh user@host -- echo test

Specify a custom secret name for the Teleport license in your values.yaml file.

yaml

teleport:
  licenseSecretName: 'my-custom-license-secret'

tsh ssh now supports the -- delimiter for passing commands or specifying the host, similar to OpenSSH.
The teleport-cluster Helm chart allows overriding the Teleport license secret name via a new configuration option.

2 details in Everything

v17.0.2 Nov 25, 2024 · release notes

Teleport v17.0.2 adds SSH session text search, Bitbucket Pipelines joining, and GitHub JWKS config

└──▷ GET THIS VERSION

$ git clone --branch v17.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.0.2

└──▷ HOW TO FIND IT

Search the text output of a live SSH session for specific commands or errors in the Web UI.

📍Use the search box in the Teleport Web UI during an active SSH session.

Support delegated joining for Bitbucket Pipelines in Machine ID
You can now search text within SSH sessions in the Web UI and Teleport Connect
Added support for directly configuring JWKS for GitHub joining

3 details in Everything

v16.4.8 Nov 20, 2024 · release notes

Adds Azure subscription-agnostic VM joining, GHES JWKS config, web terminal image protocols, and proxy peering health checks.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.8

Allow Azure VMs to join from a different subscription than their managed identity
Added support for directly configuring JWKS for GitHub joining for circumstances where the GHES is not reachable by the Teleport Auth Service
The web terminal now supports SIXEL and IIP image protocols
Added periodic health checks between proxies in proxy peering

4 details in Everything

v17.0.1 Nov 16, 2024 · release notes

Teleport v17.0.1 adds AWS IAM IC integration, nested access lists, dynamic Windows desktop registration, and tbot start CLI commands.

└──▷ GET THIS VERSION

$ git clone --branch v17.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v17.0.1

└──▷ TRY IT

List existing bot instances to inspect onboarding status

$ tctl bots instances list

Adds tbot start <mode> family of subcommands to launch services directly from the command line
Adds tctl bots instances add and tctl bots instances list subcommands for bot instance management
Adds AWS IAM Identity Center integration to sync group members via Access Lists
Adds dynamic registration capability for Windows desktops without static config file updates
Enables nested access lists where an access list can be a member of another access list

5 details in Everything

└──▷ BREAKING ON UPGRADE

!The teleport.pkg macOS installer no longer includes a separate tsh.pkg; tsh.app is now bundled inside teleport.pkg
!Hostnames are now strictly validated (<=257 chars, alphanumeric + . -); invalid hostnames are replaced with UUIDs and stored in teleport.internal/invalid-hostname label

v15.4.22 Nov 13, 2024 · release notes

Adds resolve subcommand to tsh, -- delimiter support for tsh ssh, and TBOT_USE_PROXY_ADDR env var

└──▷ GET THIS VERSION

$ git clone --branch v15.4.22 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.22

Adds a resolve command to tsh that may be used as the target for a Match exec condition in an SSH config
Updated tsh ssh to support the -- delimiter similar to openssh. It is now possible to execute a command via tsh ssh user@host -- echo test or tsh ssh -- host uptime
Postgres database session start events now include the Postgres backend PID for the session
Added a search input to the cluster dropdown in the Web UI when there's more than five clusters to show

4 details in Everything

v16.4.7 Nov 12, 2024 · release notes

Adds tsh resolve, Machine ID proxy override via TBOT_USE_PROXY_ADDR, and Kubernetes resource-scoped access requests.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.7

└──▷ TRY IT

Use tsh resolve as the SSH proxy target in ~/.ssh/config to handle leaf-cluster host lookups dynamically.

$ Host *.teleport.internal
  ProxyJump none
  ProxyCommand /usr/local/bin/tsh resolve %h

Limit an access role so that approved requests can only create or modify Pod and Service resources, not namespaces or nodes.

yaml

role:
  allow:
    request:
      kubernetes_resources:
        - kind: Pod
        - kind: Service

Adds a resolve subcommand to tsh for use as the target of Match exec conditions in SSH config
Defines a new kubernetes_resources field under role.allow.request to restrict what kinds of Kubernetes resources a requester can create or modify during access requests

2 details in Everything

v14.3.33 Oct 31, 2024 · release notes

Teleport v14.3.33 adds local disable for device auto-enroll via env var, --with-secrets flag for tctl tokens ls, and custom SQS consumer lock support.

└──▷ GET THIS VERSION

$ git clone --branch v14.3.33 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.33

└──▷ TRY IT

Prevent the agent from automatically enrolling a device in an environment where auto-enrollment is not desired.

$ export TELEPORT_DEVICE_AUTO_ENROLL_DISABLED=1

List cluster tokens including the sensitive join token secrets.

$ tctl tokens ls --with-secrets

Allows disabling Auto-enroll locally with the TELEPORT_DEVICE_AUTO_ENROLL_DISABLED=1 environment variable
Adds --with-secrets flag to tctl tokens ls command to display secret join token values
Supports custom SQS consumer lock name and disabling a consumer in the Event Handler plugin

3 details in Everything

v16.4.6 Oct 23, 2024 · release notes

Teleport v16.4.6 adds tctl bot instance subcommands, TELEPORT_DEVICE_AUTO_ENROLL_DISABLED env var, and new metrics.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.6

Add new tctl subcommands to manage bot instances
Automatic device enrollment may be locally disabled using the TELEPORT_DEVICE_AUTO_ENROLL_DISABLED=1 environment variable
Added a new teleport_roles_total metric that exposes the number of roles which exist in a cluster
Add support for the Datadog Incident Management plugin helm chart
Extend the Datadog plugin to support automatic approvals

+1 more show less

Allow using a custom database for Firestore backends

6 details in Everything

v15.4.21 Oct 23, 2024 · release notes

Teleport v15.4.21 adds teleport_roles_total metric, TELEPORT_DEVICE_AUTO_ENROLL_DISABLED env var, custom SQS consumer settings, Firestore backend customization, tctl --with-secrets flag, and RBAC session listing fix

└──▷ GET THIS VERSION

$ git clone --branch v15.4.21 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.21

└──▷ TRY IT

Check Prometheus for role count in your cluster

$ curl -s http://localhost:3000/metrics | grep teleport_roles_total

Prevent automatic device enrollment on a specific node by setting the environment variable before starting the service

$ export TELEPORT_DEVICE_AUTO_ENROLL_DISABLED=1
sudo systemctl restart teleport

View secret join tokens that are normally hidden by tctl tokens ls

$ tctl tokens ls --with-secrets

Adds the teleport_roles_total metric to expose the number of roles in a cluster
Enables local disabling of automatic device enrollment via TELEPORT_DEVICE_AUTO_ENROLL_DISABLED=1 environment variable
Allows custom SQS consumer lock name and consumer disabling for event handler integrations
Supports using a custom database for Firestore backends
Adds --with-secrets flag to tctl tokens ls to unredact secret join token values

5 details in Everything

v16.4.3 Oct 16, 2024 · release notes

Teleport v16.4.3 adds Workload ID JWT SVID support, tctl AccessMonitoringRule commands, and tctl tokens ls --with-secrets flag.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.3

└──▷ TRY IT

List join tokens with their actual secret values for automation or auditing purposes.

$ tctl tokens ls --with-secrets

Retrieve details of an AccessMonitoringRule resource using the tctl CLI for programmatic management.

$ tctl get AccessMonitoringRule --name=<rule_name>

Add --with-secrets flag to tctl tokens ls command to include secret join token values in output
Adds AccessMonitoringRule resource listing and retrieval capabilities to the tctl CLI
Enable Teleport Workload ID to issue JWT SVIDs via the Workload API for OIDC federation compatibility
Add sshAgent.addKeysToAgent config option in Teleport Connect to control local SSH agent interaction
Add ssh.forwardAgent config option in Teleport Connect to control SSH agent forwarding behavior

+1 more show less

Extend Teleport Discovery Service to support resource discovery across all projects accessible by the service account

6 details in Everything

v15.4.20 Oct 10, 2024 · release notes

Added access monitoring rules management via tctl and new SSH agent config options in Teleport Connect

└──▷ GET THIS VERSION

$ git clone --branch v15.4.20 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.20

Adds the ability to list and get access monitoring rules resources using tctl
Adds the sshAgent.addKeysToAgent configuration option in Teleport Connect to control interaction with the local SSH agent
Adds the ssh.forwardAgent configuration option in Teleport Connect to control SSH agent forwarding

3 details in Everything

v14.3.32 Oct 3, 2024 · release notes

Teleport v14.3.32 adds session termination controls and enforces device_trust.mode for OSS/Enterprise pairs

└──▷ GET THIS VERSION

$ git clone --branch v14.3.32 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.32

Session participants now see available controls to terminate or leave the session
Enforces a global device_trust.mode=required on OSS processes paired with an Enterprise Auth server

2 details in Everything

└──▷ BREAKING ON UPGRADE

!OSS processes paired with an Enterprise Auth server now require device_trust.mode=required, otherwise they will be rejected

v16.4.1 Sep 25, 2024 · release notes

Teleport v16.4.1 adds Kubernetes secrets lookup for Connector configs, Access Request Datadog plugin support, and new static user ownership flag

└──▷ GET THIS VERSION

$ git clone --branch v16.4.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.1

Adds owner field to static host users spec to allow Teleport to automatically take ownership of existing users with matching names across hosts.
Adds support for Kubernetes secrets lookup in the GithubConnector.ClientSecret and OIDCConnector.ClientSecret fields within the Kubernetes Operator.
Adds new Access Request Datadog plugin integration for notification and workflow automation.
Adds support for Kubernetes SPDY over Websocket Protocols for PortForward connections.

4 details in Everything

v16.4.0 Sep 19, 2024 · release notes

Teleport v16.4.0 adds terraform_cloud joining, SPIFFE Federation for Workload Identity, multi-domain web apps, and Okta dashboard.

└──▷ GET THIS VERSION

$ git clone --branch v16.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.4.0

└──▷ USE IT

Configure the default shell for auto-provisioned host users via role options.

yaml

roles:
- name: default-editor
  allow:
    create_host_user_default_shell: "zsh"

Inspect the new Okta integration status dashboard in the web UI.

📍Go to Settings › Integrations › Okta Status in the Teleport Web UI.

Adds terraform_cloud joining method to enable secretless authentication on HCP Terraform jobs for the Teleport Terraform provider
Teleport Workload Identity now supports SPIFFE Federation, allowing trust relationships to be established between a Teleport cluster's trust domain and trust domains managed by other SPIFFE compatible platforms
Teleport now supports web application access where one application depends on another
Cluster admins are now able to get a detailed overview of the Okta integration status in the Teleport web UI
Added a new create_host_user_default_shell configuration under role options that changes the default shell of auto provisioned host users

+3 more show less

Machine ID now generates cluster-specific ssh_config and known_hosts files which will always direct SSH connections made using them via Teleport
The Teleport Terraform provider now supports AccessMonitoringRule resources
Emit audit logs when creating, updating or deleting Teleport Plugins

8 details in Everything

v15.4.19 Sep 18, 2024 · release notes

Adds tbot Helm chart and auth_service.ssh_dial_timeout config for cluster-wide SSH dial timeout control

└──▷ GET THIS VERSION

$ git clone --branch v15.4.19 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.19

auth_service.ssh_dial_timeout in the Teleport config file allows setting the cluster-wide SSH dial timeout.
Added tbot Helm chart for deploying a Machine ID Bot into a Teleport cluster.

2 details in Everything

v16.3.0 Sep 12, 2024 · release notes

Adds out-of-band host user creation via ssh_service.users_list, configurable auth_service.ssh_dial_timeout, and a new tbot Helm chart.

└──▷ GET THIS VERSION

$ git clone --branch v16.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.3.0

Adds users_list to ssh_service config section to enable out-of-band user creation on managed hosts without requiring an SSH session.
Adds auth_service.ssh_dial_timeout config key to set the cluster-wide SSH dial timeout.
Adds a new tbot Helm chart for deploying Machine ID Bot into a Teleport cluster.

3 details in Everything

v14.3.31 Sep 6, 2024 · release notes

Adds non-default cluster domain support in Kubernetes via cluster.local removal

└──▷ GET THIS VERSION

$ git clone --branch v14.3.31 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.31

Extends Teleport to use non-default cluster domains in Kubernetes, avoiding the assumption of cluster.local.

1 detail in Everything

v16.2.1 Sep 5, 2024 · release notes

v16.2.1 adds teleport_installer to Terraform provider, ServiceNow/PagerDuty to access request notifications, and bulk selection in UI

└──▷ GET THIS VERSION

$ git clone --branch v16.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.2.1

Added support for the teleport_installer resource to the Teleport Terraform provider.
Added ServiceNow support to access request notification routing rules.
Added PagerDuty support to access request notification routing rules.
Connect now supports bulk selection of resources to create an access request in the unified resources view.
Added eks:UpdateAccessEntry to IAM permissions generated by the teleport integration IAM setup command and to the documentation reference for auto-discovery IAM permissions.

5 details in Everything

v15.4.18 Sep 5, 2024 · release notes

Adds teleport_inst Terraform resource and auto-update API resources

└──▷ GET THIS VERSION

$ git clone --branch v15.4.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.18

Adds teleport_installer resource to the Teleport Terraform provider
Adds API resources for auto update (config and version)

2 details in Everything

v15.4.17 Aug 29, 2024 · release notes

New skip-relogin flag for tsh and EKS tagging support in Access Graph

└──▷ GET THIS VERSION

$ git clone --branch v15.4.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.17

Adds --skip-relay flag to tsh ssh and tsh proxy ssh to prevent relogin attempts on connection drop
EKS Cluster auto-enroll configurations now tag temporary Access Entry with teleport.dev/ namespaced tags
Imports S3 Bucket Tags into Teleport Policy's Access Graph via the Access Graph integration role

3 details in Everything

v16.2.0 Aug 27, 2024 · release notes

Teleport v16.2.0 adds NLA for Windows Desktops, DocumentDB IAM auth, UI join token management, and tctl terraform env

└──▷ GET THIS VERSION

$ git clone --branch v16.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.2.0

└──▷ USE IT

Enable NLA for Windows desktop sessions via environment variable.

shell

export TELEPORT_ENABLE_RDP_NLA=yes

Run the Terraform provider locally using the new subcommand.

$ tctl terraform env

Manage join tokens via the web interface instead of the CLI.

📍Navigate to the Join Tokens section in the Teleport Web UI.

Adds TELEPORT_ENABLE_RDP_NLA environment variable to enable Network Level Authentication for Windows desktop access in the windows_desktop_service.
Adds IAM authentication support for connecting to Amazon DocumentDB resources.
Enables management of join tokens directly through the Teleport web UI, replacing or supplementing tctl tokens CLI commands.
Displays database objects and their access paths for Database Access users within the Access Graph view.
Adds automatic log file reopening integration with logrotate when files are detected as renamed.

+7 more show less

Adds teleport.dev/project-id label on auto-enrolled GCP instances.
Updates Slack plugin to list logins permitted by requested roles in notifications.
Tags temporary Access Entries for new EKS Cluster auto-enroll configurations with teleport.dev/ namespaced tags.
Imports S3 Bucket Tags into Teleport Policy's Access Graph, requiring s3:GetBucketTagging permission on the integration role.
Adds tctl terraform env subcommand to simplify local execution of the Terraform provider.
Adds native MachineID support to the Terraform provider, allowing usage in delegated environments like GitHub Actions without tbot.
Improves Terraform Provider credential handling by sequentially trying sources and failing fast on expired credentials.

12 details in Everything

v16.1.8 Aug 24, 2024 · release notes

Teleport v16.1.8 adds custom notifications via tctl, SPIFFE federation endpoint, and dynamic Opsgenie recipients

└──▷ GET THIS VERSION

$ git clone --branch v16.1.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.1.8

└──▷ USE IT

Use tctl to define a custom notification resource that targets specific Teleport users for alerts or updates.

shell

tctl create -f notification-resource.yaml

tctl allows cluster administrators to create custom notifications targeting Teleport users with tctl create of notification resources.
Proxy API exposes a new SPIFFE compatible federation bundle endpoint for workload identity platforms to federate with the Teleport cluster.
Add Download CSV button to Access Monitoring Query results in the UI.
Introduce support for Envoy SDS into the Machine ID spiffe-workload-api service.
Opsgenie plugin recipients can now be dynamically configured by creating Access Monitoring Rules resources with the required Opsgenie notify schedules.

+1 more show less

Allow to limit duration of local tsh proxy certificates with a new MFAVerificationInterval option.

6 details in Everything

v15.4.16 Aug 24, 2024 · release notes

Teleport v15.4.16 adds permit_cluster_wide_ssh_dial_timeout and Envoy SDS support to Machine ID SPIFFE Workload API.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.16

Permits setting a cluster wide SSH connection dial timeout
Introduces support for Envoy SDS into the Machine ID spiffe-workload-api service

2 details in Everything

v14.3.23 Aug 9, 2024 · release notes

Teleport v14.3.23 adds audit events for AWS/Azure/Discovery actions, tsh puttyconfig port fallback, and more

└──▷ GET THIS VERSION

$ git clone --branch v14.3.23 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.23

tsh puttyconfig now uses the registered host port when invoked without --port
Added audit events for AWS and Azure integration resource actions
Added audit events for discovery config actions
tctl alerts ls now displays remaining alert TTL

4 details in Everything

v15.4.12 Aug 9, 2024 · release notes

Teleport v15.4.12 adds SPIFFE federation endpoint, Kubernetes workload attestation, and kubernetes-secret Machine ID destination.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.12 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.12

Adds metadata.expires field support for Bot resources to allow automatic expiration of bot credentials
Adds kubernetes-secret schema to the command line to configure Machine ID secret destinations
Adds SPIFFE compatible federation bundle endpoint to the Proxy API for external workload identity federation
Adds Kubernetes Workload Attestation to Teleport Workload Identity for pod authentication without secrets
Adds TERM_PROGRAM environment variables Teleport_Connect and TERM_PROGRAM_VERSION in Teleport Connect integrated terminal

5 details in Everything

v16.1.3 Aug 7, 2024 · release notes

New Kubernetes Workload Attestation for Teleport Workload Identity and SSO Device Trust authorization

└──▷ GET THIS VERSION

$ git clone --branch v16.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.1.3

└──▷ USE IT

Ensure your scripts can identify the Teleport Connect environment via the new TERM variables.

shell

echo $TERM_PROGRAM

tbot now emits a warning on startup when the requested certificate TTL exceeds the maximum allowed value
Added TERM_PROGRAM: Teleport_Connect and TERM_PROGRAM_VERSION: <app_version> environment variables in Teleport Connect's integrated terminal
SAML applications can now be deleted directly from the Web UI

3 details in Everything

v16.1.1 Jul 31, 2024 · release notes

Adds kubernetes-secret schema for Machine ID secrets, --skip-idle-time to tsh play, and SSO client redirect CIDR filtering

└──▷ GET THIS VERSION

$ git clone --branch v16.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.1.1

└──▷ USE IT

Skip idle timeout logic when playing back session recordings for continuous monitoring or debugging.

shell

tsh play --skip-idle-time <session-id>

Machine ID can now be configured to use Kubernetes Secret destinations from the command line using the kubernetes-secret schema.
Added option to allow client redirects from IPs in specified CIDR ranges in SSO client logins.
Added audit events for AWS and Azure integration resource actions.
Added --skip-idle-time flag to tsh play.

4 details in Everything

v15.4.11 Jul 30, 2024 · release notes

Teleport v15.4.11 adds Teams support to Opsgenie plugin and dynamic profiling via SIGUSR1.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.11

SIGUSR1 signal handling added to dynamically capture profiles for event-handler diagnostics
Opsgenie plugin alert creation now supports Teams configuration

2 details in Everything

v15.4.10 Jul 29, 2024 · release notes

New application-tunnel service in Machine ID, tbot systemd subcommand, --skip-idle-time for tsh play, and JSON access list listing.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.10

└──▷ TRY IT

Play back recorded sessions without pausing for idle time to speed up review workflows.

$ tsh play <session_id> --skip-idle-time

Added application-tunnel service to Machine ID for establishing a long-lived tunnel to a HTTP or TCP application for Machine to Machine access.
Added the tbot install systemd command for installing tbot as a service on Linux systems.
Added a --skip-idle-time flag to tsh play.
Added ability to list access list members in json format in tctl cli tool.

4 details in Everything

v16.1.0 Jul 16, 2024 · release notes

Database query replays, tbot systemd install, JSON access lists, and more in Teleport v16.1.0

└──▷ GET THIS VERSION

$ git clone --branch v16.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.1.0

└──▷ TRY IT

Install the tbot daemon as a background service on Linux for automated machine identity management.

$ tbot install systemd

Export access list members in a machine-parseable format for integration with other systems.

$ tctl get accesslists/members --format=json

Configure Teleport Enterprise to send usage reports through a corporate proxy server.

$ export TELEPORT_REPORTING_HTTP_PROXY=http://proxy.internal:8080

Adds tbot install systemd command for installing the bot daemon as a Linux service.
Adds PostgreSQL query replay capability to Database Access sessions, viewable in the web UI or via tsh.
Enables JSON output for access list members via tctl.
Updates Teleport AMIs to optionally source environment variables from /etc/default/teleport.
Adds TELEPORT_REPORTING_HTTP(S)_PROXY environment variable support in Teleport Enterprise for reporting proxy configuration.

+1 more show less

Enables event type filtering (forward, skip events, skip session types) in the event-handler Helm chart.

6 details in Everything

v15.4.9 Jul 11, 2024 · release notes

tsh ssh now respects proxy templates; Machine ID outputs run concurrently

└──▷ GET THIS VERSION

$ git clone --branch v15.4.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.9

Machine ID execution engine runs outputs individually and concurrently, preventing one failing output from blocking others.
Event-handler Helm chart adds ability to forward events, skip events by type, and skip session types via new configuration options.

2 details in Everything

v15.4.7 Jul 4, 2024 · release notes

Teleport v15.4.7 adds leaf cluster dialling to tbot, supports non-default K8s domains, and introduces TELEPORT_REPORTING_HTTP(S)_PROXY env var

└──▷ GET THIS VERSION

$ git clone --branch v15.4.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.7

Adds support for tbot to dial leaf clusters via the SSH multiplexer
Extends Teleport Kubernetes integration to use non-default cluster domains (no longer assumes cluster.local)
Adds TELEPORT_REPORTING_HTTP_PROXY and TELEPORT_REPORTING_HTTPS_PROXY environment variables in Enterprise for usage reporting proxy configuration
Implements disable_exec_plugin as the default behavior when Machine ID writes a Kubeconfig to a directory destination

4 details in Everything

v16.0.4 Jul 4, 2024 · release notes

Machine ID enables leaf cluster dialling via tbot and supports TELEPORT_REPORTING_HTTP(S)_PROXY env var in Enterprise

└──▷ GET THIS VERSION

$ git clone --branch v16.0.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.0.4

Adds TELEPORT_REPORTING_HTTP(S)_PROXY environment variable support to Teleport Enterprise for configuring the HTTP/HTTPS proxy used by the usage reporting ingest service.

1 detail in Everything

v15.4.6 Jul 1, 2024 · release notes

Teleport v15.4.6 adds Debug config to event-handler, system CA trust for self-hosted DBs, and alert TTL display.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.6

Adds Debug setting to the event-handler configuration
Enables trusting system CAs for self-hosted databases
tctl alerts ls now displays remaining alert ttl

3 details in Everything

v16.0.3 Jul 1, 2024 · release notes

New tctl desktop bootstrap command and Debug event-handler setting; UI error display for SSH/K8s sessions

└──▷ GET THIS VERSION

$ git clone --branch v16.0.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.0.3

└──▷ USE IT

Automate the initial setup of Active Directory for Desktop Access using Teleport.

shell

tctl desktop bootstrap --help

Enable debug-level logging for event-handler troubleshooting via Helm values.

yaml

eventHandler:
  debug: true

Adds tctl desktop bootstrap subcommand to bootstrap AD environments for Desktop Access.
Adds Debug configuration setting for the event-handler subsystem.
Adds audit event field tracking changes to the MFA for admin actions requirement.
Adds support to trust system CAs for self-hosted databases.
Adds error display in the Web UI for SSH and Kubernetes sessions.

+1 more show less

Makes tctl alerts ls display remaining alert TTL.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!The teleport updater no longer defaults to using the global version channel.

v15.4.5 Jun 27, 2024 · release notes

Adds crown_jewel resource support and Web UI editing for user traits.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.5

└──▷ HOW TO FIND IT

Manage user attributes via the interface for roles or policies.

📍In the Web UI, navigate to Users › [User Name] › Traits and edit the traits directly.

Added support for the crown_jewel resource type
Added ability to edit user traits from the Web UI

2 details in Everything

v14.3.21 Jun 27, 2024 · release notes

Adds --node-name flag to teleport configure and UI editing of user traits.

└──▷ GET THIS VERSION

$ git clone --branch v14.3.21 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.21

└──▷ USE IT

Override the generated node hostname during Teleport agent configuration.

shell

teleport configure --node-name=my-server-01

Modify existing user attributes without API access.

📍In the Web UI, go to Users › [Username] and edit the Traits section.

The teleport configure command now supports a --node-name flag for overriding the node's hostname.
Added ability to edit user traits from the Web UI.

2 details in Everything

v16.0.1 Jun 18, 2024 · release notes

tctl config behavior when auth_service is disabled; add ability to edit user traits from the Web UI

└──▷ GET THIS VERSION

$ git clone --branch v16.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.0.1

tctl now ignores any configuration file if the auth_service section is disabled, preferring credentials from a given identity file or tsh profile instead

1 detail in Everything

v16.0.0 Jun 13, 2024 · release notes

Teleport v16 adds Teleport VNet for VPN-like access, tctl for Windows, and per-session MFA for all clients.

└──▷ GET THIS VERSION

$ git clone --branch v16.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v16.0.0

└──▷ USE IT

Configure the proxy to hide requestable resources from the main view, showing only currently accessible ones.

shell

tctl edit ui_config

Adds support for per-session MFA checks when accessing web and TCP applications via tsh, Web UI, or Teleport Connect
Supports per-session MFA for database resources in Teleport Connect
New ui_config resource with show_resources: accessible_only to hide requestable resources from the main view
Jamf plugin authenticates using Jamf API credentials instead of username and password

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Auth server refuses to start if second_factor is not set to on, webauthn, or otp for local users.
!Connections from clients and agents running incompatible (too old) versions are rejected unless TELEPORT_UNSTABLE_ALLOW_OLD_CLIENTS=yes is set.
!Opsgenie plugin roles now require separate annotations: teleport.dev/notify-services for notifications and teleport.dev/schedules for auto-approval checks.
!DynamoDB backend requires dynamodb:ConditionCheckItem IAM permission.
!auth_service.assist and proxy_service.assist configuration options are removed; Teleport will not start if they are present.
!Active Directory installation and configuration wizard is removed.

v15.4.3 Jun 12, 2024 · release notes

Introduces fdpass-teleport binary and ssh-multiplexer service for Machine ID to reduce resource consumption.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.3

Introduce the new Machine ID ssh-multiplexer service for significant improvements in SSH performance
Adds fdpass-teleport binary that can be optionally used by Machine ID

2 details in Everything

v15.4.2 Jun 11, 2024 · release notes

New --node-name flag for teleport configure, GCP Cloud SQL Postgres backend support, and plugin resource in tctl.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.2

└──▷ USE IT

Override the node hostname during initial Teleport configuration

shell

teleport configure --node-name=custom-hostname

Manage plugin resources using the updated tctl tool

shell

tctl plugins list

teleport configure command now supports a --node-name flag for overriding the node's hostname
Added support for Microsoft Entra ID directory synchronization (Teleport Enterprise only, preview)
Added experimental support for storing audit events in cockroach
Added Prometheus metrics for the Postgres event backend
Added GCP Cloud SQL for PostgreSQL backend support

+1 more show less

Added support plugin resource in tctl tool

6 details in Everything

v15.4.0 May 31, 2024 · release notes

Teleport v15.4.0 adds GCP Spanner support, Slack routing rules for access requests, and tctl management of monitoring rules.

└──▷ GET THIS VERSION

$ git clone --branch v15.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.4.0

└──▷ USE IT

Dynamically increase log verbosity for debugging without restarting the service

shell

teleport debug set-log-level server:debug

Manage access monitoring rules via CLI

shell

tctl get accessmonitoringrules

Adds teleport debug set-log-level / profile commands to change log level or collect pprof profiles without restart
Adds ability to manage access monitoring rules via tctl
Adds support for GCP Spanner to Teleport Database Service
Hosted Slack plugin users can now configure notification routing rules for role-based access requests
Teleport Workload ID now supports basic workload attestation on Unix systems based on UID/PID/GID

5 details in Everything

v14.3.20 May 23, 2024 · release notes

Teleport v14.3.20 adds allowed_https_hostnames config key for SSO callbacks, audit logging of Bot/Instance join remote addresses, and read-only maintenance config permissions.

└──▷ GET THIS VERSION

$ git clone --branch v14.3.20 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.20

Adds the client_redirect_settings.allowed_https_hostnames config key (in the auth connector spec) to whitelist allowed callback URLs for SSO logins

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!Teleport will now disallow non-localhost callback URLs for SSO logins unless configured via client_redirect_settings.allowed_https_hostnames.

v15.3.6 May 23, 2024 · release notes

Teleport v15.3.6 adds tctl Okta and webauthn diagnostics, SCIM tooling, GCP labels, and new env var for SSH ProxyCommand

└──▷ GET THIS VERSION

$ git clone --branch v15.3.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.3.6

└──▷ TRY IT

Adopt the new high-performance ProxyCommand path for Machine ID and SSH connections.

$ export TBOT_SSH_CONFIG_PROXY_COMMAND_MODE=new

Diagnose WebAuthn issues directly from the CLI.

$ tctl webauthn diagnostics --user <username>

Added support for creating Okta integrations with tctl.
Added the TBOT_SSH_CONFIG_PROXY_COMMAND_MODE=new environment variable to adopt an improved-performance ProxyCommand implementation for Machine ID and SSH.
Added webauthn diagnostics commands to tctl.
Added tooling to create SCIM integrations in tctl.
Added automatic GCP label importing.

+1 more show less

Added the ability for teleport-event-handler to skip certain event types when forwarding to an upstream server.

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Teleport now disallows non-localhost callback URLs for SSO logins unless configured; users must add client_redirect_settings.allowed_https_hostnames to their auth connector configuration.

v13.4.24 May 8, 2024 · release notes

Teleport v13.4.24 adds lock target to deletion audit events and enforces server-side allow_passwordless.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.24 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.24

v14.3.18 May 8, 2024 · release notes

Teleport v14.3.18 adds unix socket listener support for tbot database-tunnel service.

└──▷ GET THIS VERSION

$ git clone --branch v14.3.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.18

v15.3.1 May 8, 2024 · release notes

tbot database-tunnel listener can now bind to a unix socket

└──▷ GET THIS VERSION

$ git clone --branch v15.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.3.1

Added lock target field to lock deletion audit events.

1 detail in Everything

v14.3.17 May 1, 2024 · release notes

Adds TPM join method and ssh_config control for Machine ID Identity Outputs

└──▷ GET THIS VERSION

$ git clone --branch v14.3.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.17

Added the tpm join method, allowing secure cluster joining in on-prem environments without a shared secret
Added control over ssh_config generation in Machine ID's Identity Outputs via the new config key

2 details in Everything

v15.3.0 May 1, 2024 · release notes

Teleport v15.3.0 adds TPM join method for agents and Machine ID bots.

└──▷ GET THIS VERSION

$ git clone --branch v15.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.3.0

Adds tpm as a supported join method for securing agent and Machine ID bot onboarding without secret tokens
Supports hardware key MFA checks when connecting to agentless OpenSSH nodes

2 details in Everything

v15.2.5 Apr 27, 2024 · release notes

Teleport v15.2.5 adds tpm join method, fuzzy matching for proxy templates, and optional SSH config generation in Machine ID.

└──▷ GET THIS VERSION

$ git clone --branch v15.2.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.2.5

podSecurityContext is a new configurable field in the teleport-cluster Helm chart
Proxy templates now support target host resolution via a predicate expression or fuzzy matching
Machine ID Identity Outputs allow controlling ssh_config generation to disable it when unnecessary

3 details in Everything

v13.4.23 Apr 26, 2024 · release notes

New audit log events for denied bot joins and cert.create, plus custom Jamf page size.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.23 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.23

Teleport Connect now shows all recent connections instead of capping them at 10
Added a new Prometheus metric to track requests initiated by Teleport against the control plane API
Reduced default Jamf inventory page size, allow custom values to be provided.
Added a new Audit log event that is emitted when an Agent or Bot request to join the cluster is denied

4 details in Everything

v14.3.16 Apr 25, 2024 · release notes

New audit log event for denied Agent/Bot join requests and configurable labels for tbot kubernetes_secret destination

└──▷ GET THIS VERSION

$ git clone --branch v14.3.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.16

└──▷ TRY IT

Alert on bot join failures by watching the new audit log event type.

$ tctl events --from now-1h --until now --format json | jq '.Events[] | select(.Type == "denied_join_cluster")'

Added denied_join_cluster Audit log event emitted when an Agent or Bot request to join the cluster is rejected
Added label configuration support for Kubernetes secrets created by the kubernetes_secret destination in tbot
Added Prometheus metric tracking requests initiated by Teleport against the control plane API

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Generic not found errors are returned whether a remote cluster can't be found or access is denied

v15.2.4 Apr 24, 2024 · release notes

New regexp.match filter, Azure CLI access via Entra Workload ID, and audit logging for denied Agent/Bot joins

└──▷ GET THIS VERSION

$ git clone --branch v15.2.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.2.4

Adds regexp.match to access request filter and where expressions to enable regex-based filtering logic
Adds Azure CLI access support on AKS with Entra Workload ID, allowing teleported agents to authenticate as Azure users via federated identity
Added a new Audit log event that is emitted when an Agent or Bot request to join the cluster is denied

3 details in Everything

v15.2.2 Apr 11, 2024 · release notes

Teleport v15.2.2 adds tsh proxy kube --exec mode, automatic role access requests, and new config fields for discovery matchers.

└──▷ GET THIS VERSION

$ git clone --branch v15.2.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.2.2

Automatic role access requests feature allows users to request role assignments through the UI without manual intervention
Adds Integration and KubeAppDiscovery fields to the file configuration for AWS discovery matchers
Adds tsh proxy kube --exec subcommand that spawns a background kube proxy and re-executes the user shell with the appropriate kubeconfig
Updates the UI to hide cluster names in connection lists when only one cluster is available

4 details in Everything

v15.2.1 Apr 5, 2024 · release notes

Teleport v15.2.1 adds database-tunnel service to tbot, resource filtering on list labels, and new Machine ID output option

└──▷ GET THIS VERSION

$ git clone --branch v15.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.2.1

└──▷ TRY IT

Filter resources by checking if a comma-separated label contains a specific element.

$ tctl get nodes --filter='contains(split(labels[team], ","), "dev")'

Adds the database-tunnel subcommand to tbot, replacing tbot proxy db for authenticated database tunnels
Adds contains(split(labels[<label>], ","), <value>) predicate to allow exact matches on list elements in resource filtering
Adds disable_exec_plugin option to the Machine ID Kubernetes Output to remove the dependency on tbot existing in the target environment

3 details in Everything

v15.2.0 Mar 30, 2024 · release notes

Teleport v15.2 adds Workload Identity MVP, GCP console access via Workforce Identity Federation, and Helm chart CRD/operator separation.

└──▷ GET THIS VERSION

$ git clone --branch v15.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.2.0

└──▷ USE IT

Export the SPIFFE CA for external mTLS integration.

shell

teleport tls auth export --type tls-spiffe

Access GCP web console using Workforce Identity Federation.

📍Configure Teleport as SAML IdP for Workforce Identity Federation to enable GCP console access.

Adds Workload Identity MVP to Machine ID for bootstrapping identity across environments.
Adds tls auth export --type tls-spiffe command and /webapi/auth/export endpoint to export the SPIFFE CA.
Adds GCP console access support via Workforce Identity Federation using Teleport as a SAML IdP.
Adds operator.installCRDs config key (Helm) to control CRD installation separately from the operator.
Allows requesting specific access start time in web UI up to one week in advance.

+1 more show less

Enables automatic database access requests submission when connecting via tsh db connect or tsh proxy db.

6 details in Everything

v14.3.14 Mar 28, 2024 · release notes

Teleport v14.3.14 adds Kubernetes websocket streaming subprotocol v5 support

└──▷ GET THIS VERSION

$ git clone --branch v14.3.14 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.14

v15.1.10 Mar 27, 2024 · release notes

Teleport v15.1.10 adds automatic access request support for tsh db commands and database label templating

└──▷ GET THIS VERSION

$ git clone --branch v15.1.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.1.10

Adds automatic access request support for tsh db login, tsh db connect and tsh proxy db
Adds audit events for database auto user provisioning
Database object labels now support templates

3 details in Everything

v14.3.13 Mar 20, 2024 · release notes

Teleport v14.3.13 enforces explicit AccessList membership and adds AWS S3 bucket field requirements.

└──▷ GET THIS VERSION

$ git clone --branch v14.3.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.13

Require AWS S3 bucket fields when creating/editing AWS OIDC integration in the web UI
Removed implicit AccessList membership and ownership modes; all AccessList owners and members must be explicitly specified

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Implicit AccessList membership and ownership modes have been removed; all AccessList owners and members must now be explicitly specified.

v15.1.9 Mar 20, 2024 · release notes

Teleport v15.1.9 adds remote port forwarding to tsh and default SAML relay state configuration

└──▷ GET THIS VERSION

$ git clone --branch v15.1.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.1.9

Requires AWS S3 bucket fields (bucket name and region) when creating or editing an AWS OIDC integration through the web UI.

1 detail in Everything

v13.4.20 Mar 17, 2024 · release notes

Teleport v13.4.20 adds moderated file transfer controls and auto-loading Enterprise license files.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.20 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.20

Limits in-flight moderated file transfer requests to one per session and restricts necessary operations during transfers
Teleport Enterprise automatically loads the license file from the configured data directory when not otherwise specified

2 details in Everything

v13.4.19 Mar 16, 2024 · release notes

Teleport v13.4.19 adds license auto-loading and moderated file transfer limits

└──▷ GET THIS VERSION

$ git clone --branch v13.4.19 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.19

Adds automatic license file loading from the configured data directory for Teleport Enterprise if not explicitly specified
Limits in-flight file transfer requests to one per session during moderated file transfers

2 details in Everything

v14.3.8 Mar 16, 2024 · release notes

Adds tsh login -i for identity file authentication in CI environments

└──▷ GET THIS VERSION

$ git clone --branch v14.3.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.8

└──▷ USE IT

Authenticate as a bot or CI runner using a static keypair instead of MachineID.

shell

tsh login -i /path/to/identity.pem --proxy=teleport.example.com

Support logging in with an identity file using the tsh login -i <identity_file> command.
Teleport Enterprise now attempts to load the license file from the configured data directory if not otherwise specified.

2 details in Everything

v15.1.6 Mar 16, 2024 · release notes

Teleport v15.1.6 adds remote port forwarding for Teleport and OpenSSH nodes

└──▷ GET THIS VERSION

$ git clone --branch v15.1.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.1.6

Added remote_port_forwarding capability to Teleport nodes for proxying connections through the cluster.
Added remote_port_forwarding support for standard OpenSSH nodes allowing them to initiate outbound forwarded ports via the cluster.

2 details in Everything

v15.1.5 Mar 16, 2024 · release notes

Adds preset field to saml_idp_service_provider spec; re-enables AWS IMDSv1 fallback controlled by env var.

└──▷ GET THIS VERSION

$ git clone --branch v15.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.1.5

└──▷ TRY IT

Disable the newly enabled IMDSv1 fallback behavior on Linux hosts.

$ export AWS_EC2_METADATA_V1_DISABLED=true
# then restart teleport service

Adds a new preset field to the saml_idp_service_provider spec for specifying predefined SAML service provider profiles
Re-enables AWS IMDSv1 fallback, controllable via the AWS_EC2_METADATA_V1_DISABLED environment variable

2 details in Everything

v13.4.18 Mar 13, 2024 · release notes

Adds GCP MySQL IAM Authentication support and raises concurrent connection limits for proxy peering.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.18

Adds GCP MySQL access IAM Authentication support
Raises the concurrent connection limits between Teleport Cloud regions and in clusters that use proxy peering

2 details in Everything

v15.1.4 Mar 13, 2024 · release notes

Adds a new password change wizard for Desktop Access sessions.

└──▷ GET THIS VERSION

$ git clone --branch v15.1.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.1.4

└──▷ HOW TO FIND IT

Allow users to change their passwords via the GUI without needing SSH access.

📍Navigate to the Desktop Access session view and select Change Password in the new wizard.

v14.3.7 Mar 12, 2024 · release notes

Teleport v14.3.7 adds GCP MySQL IAM auth, tbot-distroless image, and ssh_service.enhanced_recording.root_path config

└──▷ GET THIS VERSION

$ git clone --branch v14.3.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.7

└──▷ USE IT

Explicitly set the Proxy address for TBot instead of relying on --auth-server.

shell

tbot run --proxy-server=teleport.example.com:443

Adds --proxy-server flag to TBot for explicitly configuring the Proxy address.
Adds GCP MySQL access IAM Authentication support.
Adds a tbot-only tbot-distroless container image with an 80% size reduction over the standard teleport image.
Adds ssh_service.enhanced_recording.root_path configuration option to change the cgroup slice path used by the agent.

4 details in Everything

v15.1.3 Mar 8, 2024 · release notes

Adds tsh workload issue command, SPIFFE SVID generation for tbot, GCP MySQL IAM Auth, and --proxy-server flag

└──▷ GET THIS VERSION

$ git clone --branch v15.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.1.3

Adds tsh workload issue command for issuing SVIDs using tsh.
SPIFFE SVID generation introduced to tbot (experimental).
Added GCP MySQL access IAM Authentication support.
TBot now supports --proxy-server for explicitly configuring the Proxy address.
Adds database permission management support for Postgres.

5 details in Everything

v15.1.0 Mar 1, 2024 · release notes

Teleport v15.1.0 adds tbot Docker image, Okta group sync, EKS auto-discovery UI, and enhanced mouse pointers.

└──▷ GET THIS VERSION

$ git clone --branch v15.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.1.0

Ships a standalone tbot Docker image omitting other Teleport binaries for Machine ID users
Okta integration now supports automatic synchronization of Okta groups and app assignments to Teleport access lists
Access Management UI offers auto-discovery option during EKS enrollment flow
Adds ssh_service.enhanced_recording.root_path configuration option to change the cgroup slice path used by the agent

4 details in Everything

v13.4.17 Mar 1, 2024 · release notes

Adds ssh_service.enhanced_recording.root_path config and distroless tbot image for smaller deployments.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.17

Added ssh_service.enhanced_recording.root_path configuration option to change the cgroup slice path used by the agent
tbot-distroless image is now published. This contains just the tbot binary and therefore has a smaller image size.
Optionally permit the auth server to terminate client connections from unsupported versions.

3 details in Everything

v14.3.6 Feb 17, 2024 · release notes

Adds tsh sessions ls for listing active sessions and allows auth server to terminate unsupported client connections.

└──▷ GET THIS VERSION

$ git clone --branch v14.3.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.6

└──▷ TRY IT

View all currently active Teleport sessions via CLI.

$ tsh sessions ls

Added a tsh sessions ls command to list active sessions
Permits the auth server to terminate client connections from unsupported versions

2 details in Everything

v15.0.2 Feb 16, 2024 · release notes

Teleport v15.0.2 adds tsh sessions ls command, Machine ID bot management UI, and hardware key validation

└──▷ GET THIS VERSION

$ git clone --branch v15.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.0.2

Adds the tsh sessions ls command to list active sessions.
Adds the ability to view and manage Machine ID bots from the UI.
Adds option to validate hardware key serial numbers with hardware key support.

3 details in Everything

v15.0.1 Feb 6, 2024 · release notes

Adds SCIM provisioning support for Okta in Teleport Cloud and the web UI

└──▷ GET THIS VERSION

$ git clone --branch v15.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.0.1

└──▷ HOW TO FIND IT

Enable SCIM provisioning for Okta users directly through the Teleport dashboard.

📍In the console, go to Account › Integrations › Okta and enable SCIM support.

v14.3.4 Feb 2, 2024 · release notes

tbot proxy kube subcommand for L7 LB Kubernetes auth; tctl idp saml test-attribute-mapping command for SAML testing

└──▷ GET THIS VERSION

$ git clone --branch v14.3.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.4

└──▷ USE IT

Connect to a Kubernetes cluster from a bot node where the Teleport Proxy sits behind an L7 load balancer using Machine ID.

shell

tbot proxy kube --kubeconfig ~/.kube/config

Validate the SAML IdP attribute mapping configuration before deploying changes.

shell

tctl idp saml test-attribute-mapping --config /etc/teleport/saml/config.yaml

Adds tbot proxy kube to support connecting to Kubernetes clusters using Machine ID when the Proxy is behind a L7 LB
Emit audit events when SFTP or SCP commands are blocked

2 details in Everything

v15.0.0 Feb 1, 2024 · release notes

Teleport v15 adds SSH connection resumption, AWS KMS CA storage, device challenge solving via tsh proxy app, and streaming session playback with --speed

└──▷ GET THIS VERSION

$ git clone --branch v15.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v15.0.0

└──▷ TRY IT

Stream large session recordings and accelerate playback to review events quickly without downloading the full file first.

$ tsh play <session-id> --speed 2

Configure Teleport to store its CA keys in AWS KMS for enhanced security compliance.

yaml

# Requires enabling AWS KMS support in the teleport.yaml config and performing a CA rotation
# Example config snippet:
# auth_service:
#   encryption:
#     type: aws-kms
#     kms_region: us-west-2
#     kms_key_id: arn:aws:kms:us-west-2:123456789012:key/12345678-1234-1234-1234-123456789012

Enforce device trust by solving challenges when proxying applications, ensuring only authorized devices can access.

$ tsh proxy app --device-trust my-app

Adds automatic SSH connection resumption and transparent migration for interrupted sessions when connecting a v15 client to a v15 node
Enables TPM-based Device Trust joining on Linux endpoints
Allows tsh proxy app to solve device challenges, enforcing trusted device access for applications
Adds auto-discovery configuration for RDS databases during enrollment via the Access Management UI
Enrolls EKS clusters directly through the Access Management UI

+13 more show less

Automates SAML service provider descriptor fetching and supports attribute mapping in the Access Management UI
Uses SCIM to accelerate Okta user/group provisioning performance
Supports AWS KMS for storing and handling Teleport CA private key material without leaving AWS
Enforces MFA taps for administrative actions via tctl or web UI when second_factor: webauthn is configured
Prompts for MFA in Teleport Connect before accessing Kubernetes clusters with per-session MFA enabled
Adds TCP and web application launch support to Teleport Connect, including AWS and SAML apps in browser
Streams session recordings from the auth server instead of downloading entirely before playback
Adds --speed flag to tsh play for controlling playback speed
Enables seeking to arbitrary positions during desktop session playback
Migrates Resources and Active Sessions UI elements to a responsive top navbar with distinct Passkeys and MFA device lists in Account Settings
Releases a standalone Kubernetes Operator that reconciles resources independently of the Teleport auth sidecar
Introduces TeleportRoleV6 and TeleportRoleV7 resource kinds for Kubernetes Operator role creation
Provides FIPS-compliant Linux builds and hardened AWS AMIs for ARM64 architecture

18 details in Everything

└──▷ BREAKING ON UPGRADE

!The RDP engine now requires RemoteFX; users must enable fEnableVirtualizedGraphics in Windows registry or via Group Policy on target hosts
!tsh ssh output lines are now labeled with hostname; parsing scripts must use the --log-dir flag to separate outputs by node
!The drop host user creation mode is removed; use insecure-drop instead
!Restricted sessions for SSH have been removed; network restrictions must be implemented outside Teleport
!Legacy Debian and RPM repos (deb.releases.teleport.dev, rpm.releases.teleport.dev) are no longer publishing packages; users must switch to apt.releases.teleport.dev and yum.releases.teleport.dev
!Heavy container images (with shell) are discontinued; use distroless images at https://gallery.ecr.aws/gravitational/teleport-distroless or debug images for CLI access
!Multi-architecture Teleport Operator images no longer use architecture suffixes in tags (e.g., remove -amd64 from tag names)

v14.3.3 Jan 12, 2024 · release notes

Teleport v14.3.3 adds Kubernetes app annotation controls and client IP in audit logs

└──▷ GET THIS VERSION

$ git clone --branch v14.3.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.3

Adds k8s.app.disableServiceImport annotation to control Service imports for Kubernetes apps
Adds k8s.app.tlsSkipVerify annotation to disable TLS certificate verification for Kubernetes apps
Includes client remote IP address in administrative audit events

3 details in Everything

v14.3.1 Jan 11, 2024 · release notes

Adds tsh database role selection, callback login, future assume time, and machine ID certificate extensions.

└──▷ GET THIS VERSION

$ git clone --branch v14.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.1

└──▷ TRY IT

Login with a callback URL for automation

$ tsh login --callback=http://localhost:8080/callback

Prevent the kube-agent-updater from failing if it cannot resolve an image tag

$ teleport-kube-agent-updater --insecure-no-resolve-image

Added --callback flag to tsh login for automated session callbacks
Added --insecure-no-resolve-image flag to teleport-kube-agent-updater to disable image tag resolution on pull failure
Added future assume time capability to access requests, allowing delayed privilege escalation
Added new certificate extensions and usage reporting flags to identify Machine ID bots and their cluster activity
Adds Database Roles column to tsh db ls -v output

+2 more show less

Added support to select database roles from tsh during connection
Resources named . and .. are now forbidden in Teleport resources

7 details in Everything

└──▷ BREAKING ON UPGRADE

!Resources named . or .. are no longer allowed; rename any existing resources with these names before upgrading.

v13.4.15 Jan 11, 2024 · release notes

Teleport v13.4.15 adds role/trait grants for access list owners, Machine ID cert extensions, and agent updater flags.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.15 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.15

└──▷ USE IT

Prevent agent updates from failing when image pulling is blocked by disabling tag resolution.

shell

teleport-kube-agent-updater --insecure-no-resolve-image

access lists now support granting roles and traits to owners
Added new certificate extensions and usage reporting flags to explicitly identify Machine ID bots and their cluster activity
Support running a version server in the proxy for automatic agent upgrades
Added the --insecure-no-resolve-image flag to the teleport-kube-agent-updater

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Resources named . and .. are no longer allowed. Please review the resources in your Teleport instance and rename any resources with these names before upgrading.

v14.3.0 Dec 30, 2023 · release notes

Adds tsh latency command, include_enterprise_slug GitHub join method, and STS session tags for database access

└──▷ GET THIS VERSION

$ git clone --branch v14.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.3.0

Added a tsh latency command to monitor ssh connection latency in realtime
Support GitHub joining from Enterprise accounts with include_enterprise_slug enabled.
Added support for STS session tags in the database configuration for granular DynamoDB access.
Improved Windows hosts registration with a new static_hosts configuration field
Added vpc-id as a label to auto-discovered RDS databases

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Changed the minimal supported macOS version of Teleport Connect to 10.15 (Catalina)

v13.4.14 Dec 30, 2023 · release notes

Adds IAM join method for AWS ca-west-1 and lock.create audit event details

└──▷ GET THIS VERSION

$ git clone --branch v13.4.14 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.14

Added support for the iam join method in the ca-west-1 AWS region.
Included the lock expiration time in lock.create audit events.

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The minimal supported macOS version for Teleport Connect is now 10.15 (Catalina).

v14.2.3 Dec 15, 2023 · release notes

Teleport v14.2.3 adds ServiceNow auto-approval flow, guided SAML descriptor creation, and Slack direct notifications.

└──▷ GET THIS VERSION

$ git clone --branch v14.2.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.2.3

Adds an auto_approval option to the ServiceNow plugin configuration for ticket-based access requests
Adds guided SAML entity descriptor creation in the Web UI when no XML is provided yet
Configures the Slack integration to deliver direct messages (DMs) for access request approvals and denials

3 details in Everything

v13.4.11 Dec 15, 2023 · release notes

Teleport v13.4.11 adds insecure-drop host user creation, email-based credential reset and new invite UI for Cloud

└──▷ GET THIS VERSION

$ git clone --branch v13.4.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.11

Adds new email-based UI for inviting new local users on Teleport Cloud clusters

1 detail in Everything

v12.4.30 Dec 14, 2023 · release notes

Teleport v12.4.30 adds insecure-drop host user creation and cluster_auth_preferences shortcut

└──▷ GET THIS VERSION

$ git clone --branch v12.4.30 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.30

Adds insecure-drop host user creation mode for server access
Adds cluster_auth_preferences as a shortcut key for cluster_auth_preference configuration

2 details in Everything

v14.2.2 Dec 8, 2023 · release notes

Adds insecure-drop host user creation mode, MongoDB automatic provisioning, and Web SSH latency reporting.

└──▷ GET THIS VERSION

$ git clone --branch v14.2.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.2.2

Add database automatic user provisioning support for self-hosted MongoDB
Calculate latency of Web SSH sessions and report it to users

2 details in Everything

v14.2.1 Dec 1, 2023 · release notes

Teleport v14.2.1 adds external audit storage integration, email-based user invites, and PostgreSQL auto-user provisioning.

└──▷ GET THIS VERSION

$ git clone --branch v14.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.2.1

Adds support for External Audit Storage to store Audit Logs and Session Recordings in the customer's AWS account
Adds a new email-based UI flow for inviting new local users on Teleport Cloud clusters
Adds default database support for PostgreSQL auto-user provisioning

3 details in Everything

v13.4.10 Nov 22, 2023 · release notes

Teleport v13.4.10 adds concurrent Windows device trust collection and multi-select resource filtering in Connect.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.10

└──▷ TRY IT

Export a signed kubeconfig archive using the tctl auth sign --tar subcommand.

$ tctl auth sign --type=kube --out=kube.tar.gz

Use the Teleport Connect UI to filter for multiple resource types simultaneously.

📍In the Teleport Connect search bar, type a query and select multiple filters from the dropdown list.

tctl auth sign --tar can now export kubeconfig without crashing
Teleport Connect search bar supports selecting multiple resource filters
Windows device trust data collection is now performed concurrently

3 details in Everything

v14.2.0 Nov 21, 2023 · release notes

New Okta SSO connector auto-provisioning, Connect My Computer UI flow, and dynamic plugin credential reloading in v14.2.0

└──▷ GET THIS VERSION

$ git clone --branch v14.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.2.0

└──▷ HOW TO FIND IT

Use the new Web UI wizard to quickly onboard a local computer without CLI intervention.

📍In the Teleport Web UI, navigate to Enroll New Resource -> Connect My Computer

Adds automatic creation of SSO connectors and user sync for Okta integrations in the Enterprise Edition
Introduces a guided Connect my Computer flow in the Web UI under Enroll New Resource -> Connect My Computer for local users
Enables dynamic credential reloading for plugins, supporting short-lived credentials generated by Machine ID

3 details in Everything

v14.1.5 Nov 17, 2023 · release notes

Adds Teleport Access Graph integration, IAM support for Amazon MemoryDB, and --bootstrap for cluster networking config.

└──▷ GET THIS VERSION

$ git clone --branch v14.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.1.5

Added Teleport Access Graph integration
Added IAM Authentication support for Amazon MemoryDB Access
Allow configuring cluster_networking_config and cluster_auth_preference via --bootstrap

3 details in Everything

v13.4.9 Nov 17, 2023 · release notes

Adds IAM Authentication for Amazon MemoryDB and binary parameter audit logging for PostgreSQL

└──▷ GET THIS VERSION

$ git clone --branch v13.4.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.9

Adds IAM Authentication support for Amazon MemoryDB Access allowing IAM-based authentication for this database service.
Adds binary formatted parameters as base64 encoded strings to PostgreSQL Statement Bind audit log events.

2 details in Everything

v13.4.7 Nov 16, 2023 · release notes

tsh puttyconfig now supports host:port hostname formatting

└──▷ GET THIS VERSION

$ git clone --branch v13.4.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.7

└──▷ USE IT

Generate PuTTY config files with the port number included in the hostname field for easier import into client software.

shell

tsh puttyconfig --host=example.com:3024

v14.1.3 Nov 16, 2023 · release notes

Adds Dynamic Discovery for Databases, Auto-provisioning for Redshift/MariaDB, and tsh flag improvements

└──▷ GET THIS VERSION

$ git clone --branch v14.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.1.3

└──▷ TRY IT

Connect to a Kubernetes cluster while explicitly naming the kube context for the session.

$ tsh proxy kube --set-context-name=<context_name>

Added --set-context-name to tsh proxy kube
Added Database Automatic User Provisioning support for Redshift
Added Dynamic Discovery matching for Databases
Added Database Automatic User Provisioning support for MariaDB
Supports formatting hostname as host:port in tsh puttyconfig

5 details in Everything

v13.4.5 Oct 24, 2023 · release notes

Adds tsh puttyconfig command for Windows to configure PuTTY/WinSCP sessions

└──▷ GET THIS VERSION

$ git clone --branch v13.4.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.5

Updates tsh to accept --proxy values with https:// prefixes
Limits Snowflake decompressed request size to 10MB

2 details in Everything

v14.1.1 Oct 23, 2023 · release notes

Teleport v14.1.1 adds MySQL/PostgreSQL auto-user deletion, Assist tool selection, and DiscoveryConfig CRUD

└──▷ GET THIS VERSION

$ git clone --branch v14.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.1.1

Added MySQL auto-user deletion
Added PostgreSQL auto-user deletion
Added the ability to run a specific tool to Assist.
Added DiscoveryConfig CRUD operations

4 details in Everything

v12.4.23 Oct 19, 2023 · release notes

Teleport v12.4.23 adds Windows AD root domain support for PKI operations.

└──▷ GET THIS VERSION

$ git clone --branch v12.4.23 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.23

v14.1.0 Oct 19, 2023 · release notes

Teleport v14.1.0 adds Connect My Computer, resource pinning, Access Monitoring with Athena, EC2 Instance Connect support, and periodic access list reviews.

└──▷ GET THIS VERSION

$ git clone --branch v14.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.1.0

└──▷ USE IT

Check for pending access reviews after logging in with tsh.

shell

tsh status
# (Look for notification icon/messages regarding access lists)

Connect My Computer feature in Teleport Connect to add personal machines to a cluster without terminal usage
Resource pinning allows pinning frequently accessed resources to a separate page for easy access
Access Monitoring provides a view of risky accounts and anti-patterns using Athena as the audit log backend
Connect to EC2 instances via AWS EC2 Instance Connect endpoints without installing Teleport agents
Periodic reviews of access list members for access list owners

+8 more show less

Bots can submit access request reviews
Access review notifications when logging in via tsh or running tsh status
Database automatic user provisioning support for MySQL
Link to access request in ServiceNow incidents
New Identity Governance & Security navigation section in web UI
Ability to specify PIV slot for hardware key support
Support for Windows AD root domain for PKI operations
Resources included in Slack notification of Access Requests

13 details in Everything

v13.4.4 Oct 19, 2023 · release notes

Teleport v13.4.4 adds bot access request reviews, AD root domain PKI support, and new Identity Governance & Security UI section

└──▷ GET THIS VERSION

$ git clone --branch v13.4.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.4

tsh and tsh status now display notifications for pending access reviews
Bots can now submit reviews for access requests via the API
AWS RDS Discovery flow supports optional security group selection
PKI operations now support Windows AD root domain

4 details in Everything

v14.0.3 Oct 12, 2023 · release notes

Teleport v14.0.3 adds EC2 EICE enrollment flow, Audit Review recurrence presets, and cost-optimized Athena pagination

└──▷ GET THIS VERSION

$ git clone --branch v14.0.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.0.3

└──▷ HOW TO FIND IT

Enroll EC2 instances using the new EICE discovery flow instead of manual configuration.

📍Steps: In the Teleport Admin Console, navigate to Infrastructure › Discovery and select the EC2 with EICE flow to initiate enrollment.

Configure automated recurring Audit Review schedules using the new presets.

📍Steps: In the Teleport Admin Console, go to Access Controls › Audit Review and select Recurrence Presets to create a recurring schedule.

Adds Discover flow for enrolling EC2 Instances with EICE
Added cost optimized pagination search for athena

2 details in Everything

v13.4.3 Oct 12, 2023 · release notes

Teleport v13.4.3 introduces Audit Review recurrence presets and configurable auth unreachable errors.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.3

Adds AuditReview recurrence presets to simplify scheduling of automated review workflows
Allows the auth unreachable error message to be customized via configuration

2 details in Everything

v12.4.22 Oct 12, 2023 · release notes

Teleport v12.4.22 adds auth.unreachable error config and improves CLI messaging

└──▷ GET THIS VERSION

$ git clone --branch v12.4.22 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.22

Updates multiplexer logs to include connection information for better troubleshooting

1 detail in Everything

v14.0.1 Sep 27, 2023 · release notes

Teleport v14.0.1 adds initial ServiceNow plugin, host sudoers management without user creation, and access list visibility improvements.

└──▷ GET THIS VERSION

$ git clone --branch v14.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.0.1

Adds IneligibleStatus fields for access list members and owners
Adds Access List usage events
Added feature allowing for managing host sudoers without also creating users

3 details in Everything

v13.4.1 Sep 26, 2023 · release notes

Teleport v13.4.1 adds host sudoers management without user creation, Access List usage events and IneligibleStatus fields

└──▷ GET THIS VERSION

$ git clone --branch v13.4.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.1

└──▷ TRY IT

Check the eligibility status of access list members via the API to identify blocked users.

$ curl -s https://teleport.example.com/v2/accesslists/"<name>" | jq '.items[].member.ineligibleStatus'

Configure a host join token to manage sudoers but skip user creation.

yaml

# In the teleport cluster config.yaml or join token:
# host_sudoers: true
# create_host_user: false

Adds IneligibleStatus fields for access list members and owners to expose eligibility state
Adds feature allowing for managing host sudoers without also creating users

2 details in Everything

v12.4.20 Sep 26, 2023 · release notes

Teleport v12.4.20 adds AWS EC2 IMDSv2 support for inventory metadata

└──▷ GET THIS VERSION

$ git clone --branch v12.4.20 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.20

v14.0.0 Sep 21, 2023 · release notes

Teleport v14.0.0 introduces access lists, ClickHouse DB support, Kubernetes app auto-discovery, advanced S3/Athena audit logs, and tbot v2 config schema.

└──▷ GET THIS VERSION

$ git clone --branch v14.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v14.0.0

Adds access_list resource type to extend short-lived access requests with long-term group-based permissions
Supports Amazon S3 and Athena backends for efficient searching, sorting, and filtering of audit logs
Automatically discovers web applications in Kubernetes clusters when the discovery service is connected or deployed via Helm
Extends resource-based RBAC to custom Kubernetes resources and verbs (requires role version v7)
Adds database access support for ClickHouse HTTP and native (TCP) protocols with query audit logging

+9 more show less

Adds query audit logging support for Oracle database integrations
Allows up to 5 local Windows desktops without an enterprise license in Community Edition
Adds hosted Discord plugin for access request notifications (ServiceNow coming in 14.0.1)
Adds tsh puttyconfig command on Windows to configure PuTTY saved sessions
Enables TLS routing in Terraform examples via the USE_TLS_ROUTING variable
Allows tbot to write credentials and config files directly to Kubernetes secrets instead of local directories
Introduces v2 configuration schema for Machine ID agent tbot with explicit storage, outputs, and destination types
Changes default DynamoDB billing mode to pay_per_request (restorable via billing_mode storage config option)
Sets default role version to v7, enabling extended Kubernetes per-resource RBAC and wildcard kubernetes_resources

14 details in Everything

└──▷ BREAKING ON UPGRADE

!The environment variable TELEPORT_UNSTABLE_UNLISTED_AGENT_DIALING (set to yes) temporarily re-enables open dial; it will be removed in Teleport 15
!Teleport now requires explicit proxy_protocol: on|off in proxy_service/auth_service; the previous default behavior is deprecated
!Legacy package repositories (deb.releases.teleport.dev, rpm.releases.teleport.dev) are deprecated; packages will only go to apt.releases.teleport.dev and yum.releases.teleport.dev starting in v15
!The Cf-Access-Token header is no longer included with app access requests by default; use Teleport-JWT-Assertion or header rewriting
!Removed --cert-file and --key-file flags from tsh proxy db, replaced by --tunnel flag
!MongoDB servers prior to version 3.6 are no longer supported due to driver update
!Loading environment variables from ~/.tsh/environment fails if the path includes a symlink
!The audit event trusted_cluster_token.create is deprecated in favor of join_token.create and will be removed in Teleport 15

v13.4.0 Sep 21, 2023 · release notes

Teleport v13.4.0 adds change_feed_conn_string for PostgreSQL, single-command AWS OIDC, and query filtering to tsh/tctl.

└──▷ GET THIS VERSION

$ git clone --branch v13.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.4.0

Adds change_feed_conn_string config option for the PostgreSQL backend
Adds support for a single-command AWS OIDC integration
Adds pprof support to the Kubernetes Operator to diagnose memory use
Adds support for bot and agent joining from external Kubernetes Clusters
Extends EC2 joining capability to Discovery, MDM and Okta services

+4 more show less

Supports discovery for the new AWS region il-central-1
tsh [proxy | db | kube] subcommands now accept --query and --labels optional arguments
tsh text output in non-verbose mode displays auto-discovered resources with original names
Updates Go to v1.20.8

9 details in Everything

v12.4.18 Sep 21, 2023 · release notes

Teleport v12.4.18 adds EC2 joining for Discovery, MDM, Okta; bot/agent joining from external K8s clusters

└──▷ GET THIS VERSION

$ git clone --branch v12.4.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.18

EC2 node joining is now supported for Discovery, MDM and Okta services
Bots and agents can join from external Kubernetes Clusters

2 details in Everything

v12.4.16 Sep 6, 2023 · release notes

Adds PodMonitor support to teleport-kube-agent Helm chart

└──▷ GET THIS VERSION

$ git clone --branch v12.4.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.16

v13.3.8 Sep 5, 2023 · release notes

Teleport v13.3.8 adds Okta sync duration config and il-central-1 STS support

└──▷ GET THIS VERSION

$ git clone --branch v13.3.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.3.8

v13.3.7 Aug 29, 2023 · release notes

Adds proxy env var support for direct Kubernetes dialing, dynamic API client identity file reloading, and IAM joining over reverse tunnel port.

└──▷ GET THIS VERSION

$ git clone --branch v13.3.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.3.7

Adds support for proxy environment variables when dialing directly to the Kubernetes Cluster.

1 detail in Everything

v13.3.5 Aug 23, 2023 · release notes

Adds Teleport Assist to Web Terminal and allows tsh to register the current device for enrollment.

└──▷ GET THIS VERSION

$ git clone --branch v13.3.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.3.5

└──▷ HOW TO FIND IT

Enable AI-assisted interactions in the Web Terminal UI.

📍Open the Teleport Web UI, navigate to any active terminal session; the Assist feature is now available directly within the interface.

Register the local machine as a trusted device during tsh enrollment to streamline future access.

$ tsh login --with-current-device

Adds the ability for tsh to register and enroll the --current-device

1 detail in Everything

v12.4.15 Aug 23, 2023 · release notes

Adds tsh login --headless error, text label sorting, and ALB IP pinning for v12.4.15

└──▷ GET THIS VERSION

$ git clone --branch v12.4.15 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.15

Show explicit error if users attempt to do tsh login --headless.
tsh and tctl commands that output a text-formatted table will now consistently output resource labels as a comma-separated string, sorted by label namespace. Labels starting with teleport.dev/, teleport.hidden/, and teleport.internal/ are omitted unless the --verbose flag is used.
Added IP pinning support for TLS routing behind ALB mode.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!Resource labels starting with teleport.dev/, teleport.hidden/, or teleport.internal/ are omitted from text-formatted table output in tsh and tctl unless the --verbose flag is used.

v13.3.4 Aug 18, 2023 · release notes

Teleport v13.3.4 adds host user UID/GID creation, skipConfirm headless approval, JWT claim rewriting, and SQL Server packet auditing.

└──▷ GET THIS VERSION

$ git clone --branch v13.3.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.3.4

Allows host users to be created with specific UID/GIDs
Adds skipConfirm option to Teleport Connect headless approval flow
Adds JWT claim rewriting configuration
Adds support for auditing chunked SQL Server packets

4 details in Everything

v13.3.2 Aug 9, 2023 · release notes

Teleport v13.3.2 adds hosted Jira integration, OpenSearch storage class support, and Opsgenie auto-approval.

└──▷ GET THIS VERSION

$ git clone --branch v13.3.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.3.2

└──▷ USE IT

Use templating in kube login to dynamically name the context based on cluster attributes.

shell

tsh kube login --set-context-name '{{.ClusterName}}-kube'

tsh kube login --set-context-name now supports templating functions
Added hosted Jira integration

2 details in Everything

v13.3.1 Aug 4, 2023 · release notes

Teleport v13.3.1 adds proxy resource deletion via tctl, ECS Fargate DB deploy in web UI, and new Prometheus metrics.

└──▷ GET THIS VERSION

$ git clone --branch v13.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.3.1

└──▷ TRY IT

Delete a proxy resource using the new tctl capability.

$ tctl rm <resource_type>/<name>

Enroll a new database via the web UI to trigger an automatic ECS Fargate container deployment.

📍In the Teleport Dashboard, go to Database › Add Database and select AWS ECS Fargate as the deployment target.

Added the ability to delete proxy resources using tctl.
Added support for the web UI to automatically deploy a database service with ECS Fargate container when enrolling a new database.
Added headless approval UI to Teleport Connect.
Added new Prometheus metric for created access requests.
Added new Prometheus metrics to Kubernetes Access.

5 details in Everything

v12.4.14 Aug 4, 2023 · release notes

Adds tctl subcommand for deleting proxy resources

└──▷ GET THIS VERSION

$ git clone --branch v12.4.14 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.14

v13.3.0 Aug 1, 2023 · release notes

Teleport v13.3.0 adds Postgres backend for cluster state/audit log, Azure blob session storage, and GCP VM auto-discovery

└──▷ GET THIS VERSION

$ git clone --branch v13.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.3.0

Adds support for using PostgreSQL as the backing store for both Teleport cluster state and audit logs.
Adds Azure Blob Storage as a backend for storing session recordings.
Adds gcp-vm-auto-discovery feature to automatically discover GCP virtual machines.

3 details in Everything

v13.2.5 Jul 27, 2023 · release notes

Teleport v13.2.5 adds --resource flag to tctl request create, database selection flags to tsh, and OpenSearch region discovery.

└──▷ GET THIS VERSION

$ git clone --branch v13.2.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.2.5

└──▷ USE IT

Scope a request to a specific resource like a database or application.

shell

tctl request create --resource=db/example-db

Filter database connections using labels or query syntax in tsh.

shell

tsh db ls --labels=role=admin --query='region:us-east-1'

tctl request create now supports the --resource flag to scope resource requests
teleport node configure gains a --silent flag for unattended execution
Added --labels and --query flags to tsh for database resource selection
Added --opensearch-discovery flag to specify AWS regions for OpenSearch integration

4 details in Everything

└──▷ BREAKING ON UPGRADE

!The --type flag is now required on the tctl auth crl command
!Existing tokens can no longer be updated with create token access

v11.3.19 Jul 27, 2023 · release notes

Teleport v11.3.19 allows disabling proxy protocol in Kubernetes Access and supports spaces in data_dir paths.

└──▷ GET THIS VERSION

$ git clone --branch v11.3.19 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.19

Adds the ability to disable proxy protocol in Kubernetes Access
Allows spaces in data_dir path

2 details in Everything

v12.4.12 Jul 26, 2023 · release notes

Adds proxy_protocol disable option for Kubernetes Access; allows login/port in tsh config; improves tsh play error handling

└──▷ GET THIS VERSION

$ git clone --branch v12.4.12 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.12

└──▷ USE IT

Generate an OpenSSH config file with a custom login name and port when using tsh config

shell

tsh config --login=myuser --port=443 > ~/.ssh/config

Allow login and port to be specified when using tsh config to generate openssh configs.
Added ability to disable proxy protocol in Kubernetes Access.

2 details in Everything

v13.2.2 Jul 17, 2023 · release notes

Teleport v13.2.2 adds cluster networking config management, PagerDuty plugin, and DB bootstrap perms

└──▷ GET THIS VERSION

$ git clone --branch v13.2.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.2.2

helm chart for teleport-cluster now supports ingress configuration
New hosted PagerDuty integration available in Teleport Cloud
teleport discovery bootstrap subcommand can now set up database service permissions

3 details in Everything

v11.3.17 Jul 13, 2023 · release notes

Teleport v11.3.17 adds MOTD to web UI and refines tsh/tctl commands

└──▷ GET THIS VERSION

$ git clone --branch v11.3.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.17

Adds --reason flag to tctl alerts ack command to optionally annotate alert acknowledgment
Updates tctl alert ls command to always include the alert ID in output
Deduplicates resources in tsh request search results
Adds message of the day support in the web UI

4 details in Everything

v12.4.11 Jul 13, 2023 · release notes

Teleport v12.4.11 adds keep-auto-created users and allows specifying the GitHub API endpoint for SSO configuration.

└──▷ GET THIS VERSION

$ git clone --branch v12.4.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.11

└──▷ TRY IT

Configure GitHub SSO to use a custom API endpoint for GitHub Enterprise Server or GHE Cloud.

$ tctl sso configure github --github-api-url='https://github.internal.example.com/api/v3'

Added --github-api-url flag to tctl sso configure github command to specify a custom GitHub Enterprise API endpoint

1 detail in Everything

v13.2.1 Jul 13, 2023 · release notes

Teleport v13.2.1 adds PagerDuty plugin, GCP delegated joining, and several CLI improvements.

└──▷ GET THIS VERSION

$ git clone --branch v13.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.2.1

└──▷ TRY IT

Configure GitHub SSO using a self-hosted or enterprise GitHub instance.

$ tctl sso configure github --github-api-url=https://github.internal.example.com/api/v3

Acknowledge an alert without providing a mandatory reason string.

$ tctl alerts ack <alert_id>

Check the auto-upgrade status of agents via the CLI on Teleport Cloud.

$ tctl inventory ls

tctl sso configure github now accepts a custom GitHub API endpoint URL
tctl alerts ack no longer requires the --reason flag
tctl inventory ls displays agent auto-upgrade status on Teleport Cloud
PagerDuty hosted access plugin available for Teleport Cloud
GCP delegated joining support added to Machine ID

+1 more show less

Kube cluster matchers can specify assume_role_arn for auto-discovery

6 details in Everything

v13.2.0 Jul 6, 2023 · release notes

Teleport v13.2.0 adds Jamf integrations, RBAC label expressions, IP pinning for TLS routing, and light themes.

└──▷ GET THIS VERSION

$ git clone --branch v13.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.2.0

Adds Jamf integrations for inventory management under Device Trust
Adds support for RBAC label expressions to refine access control rules
Adds IP pinning support for TLS routing behind ALB mode
Adds light theme support in Teleport Connect and the Web UI YAML editor/terminal

4 details in Everything

v13.1.5 Jun 27, 2023 · release notes

Teleport v13.1.5 adds Opsgenie plugin, assume_role_arn for DB access, and cluster auth session limits

└──▷ GET THIS VERSION

$ git clone --branch v13.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.1.5

Adds assume_role_arn setting to database access profiles to assume an AWS IAM role during connection.
Adds a max_session_ttl option to cluster_auth_preference to control the maximum certificate lifetime.
Adds Opsgenie hosted plugin for Teleport Cloud alerts and on-call integration.

3 details in Everything

v13.1.2 Jun 22, 2023 · release notes

Teleport v13.1.2 adds Assist web UI, reviewer/requester roles, tsh headless --skip-confirm flag, OpenSearch auto-discovery, and SAML app wizard

└──▷ GET THIS VERSION

$ git clone --branch v13.1.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.1.2

└──▷ USE IT

Approve a session programmatically in CI/CD pipelines without manual intervention.

shell

tsh headless approve --skip-confirm <session_id>

Adds --skip-confirm flag to the tsh headless approve CLI command for unattended session approval.
Introduces a new Assist web UI within the Teleport platform.
Adds reviewer and requester preset roles to streamline access request workflows.
Enables OpenSearch auto-discovery for database access configurations.
Adds an Add SAML application wizard to the access management Web UI.

5 details in Everything

v12.4.8 Jun 22, 2023 · release notes

Adds --skip-confirm flag to tsh headless approve and a new SAML app wizard

└──▷ GET THIS VERSION

$ git clone --branch v12.4.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.8

Added Add SAML application wizard in the Web UI access management interface for streamlined SSO setup.

1 detail in Everything

v13.1.1 Jun 14, 2023 · release notes

v13.1.1 adds MongoDB Atlas AWS IAM auth, RBAC label expressions, and tsh app login --cluster flag.

└──▷ GET THIS VERSION

$ git clone --branch v13.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.1.1

└──▷ HOW TO FIND IT

Log in to a specific Teleport cluster when managing application access from the CLI.

📍tsh app login --cluster=my-cluster my-app

Added support for AWS IAM authentication with MongoDB Atlas databases
Added support for RBAC label expressions in role definitions
Added conditional RBAC/ServiceAccount to teleport-kube-agent post-delete hook
Added login rules to Github login event in audit log
Added Prometheus endpoint to tbot

+2 more show less

Added support for hardened AMIs
Added --cluster flag to tsh app login

7 details in Everything

v12.4.7 Jun 14, 2023 · release notes

Teleport v12.4.7 adds tctl get all lock fetching and a MachineID Prometheus endpoint

└──▷ GET THIS VERSION

$ git clone --branch v12.4.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.7

tctl get all now fetches lock objects
MachineID adds a Prometheus endpoint for statistics gathering

2 details in Everything

└──▷ BREAKING ON UPGRADE

!tsh only falls back to using SSH_TELEPORT_* environment in headless mode, dropping fallback to other contexts.

v11.3.15 Jun 13, 2023 · release notes

Adds tctl lock command for service locking, Prometheus metrics endpoint in tbot, and shell autocompletion

└──▷ GET THIS VERSION

$ git clone --branch v11.3.15 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.15

Added support for locking any Teleport service with tctl lock command.
Added Prometheus endpoint to tbot.
Added support for bash and zsh autocompletion.

3 details in Everything

v13.1.0 Jun 6, 2023 · release notes

Teleport v13.1.0 adds tctl Windows desktop creation and auto PostgreSQL DB user provisioning

└──▷ GET THIS VERSION

$ git clone --branch v13.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.1.0

Adds support for creating Windows desktops via tctl subcommand

1 detail in Everything

v12.4.6 Jun 3, 2023 · release notes

Teleport v12.4.6 adds Windows desktop registration via tctl and bash/zsh autocompletion.

└──▷ GET THIS VERSION

$ git clone --branch v12.4.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.6

└──▷ USE IT

Enable tab-completion for your shell to speed up tsh and tctl usage.

shell

source <(tsh completion bash)
# or for zsh:
# source <(tsh completion zsh)

Adds tctl commands to register Windows desktops for Teleport access
Adds autocompletion support for the bash and zsh shells

2 details in Everything

v13.0.4 Jun 1, 2023 · release notes

Teleport v13.0.4 adds remote tctl alert, tsh kubectl tracer, ElastiCache IAM auth, Okta glob groups, proxy templates to tsh ssh

└──▷ GET THIS VERSION

$ git clone --branch v13.0.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.0.4

Adds tsh kubectl support for tracer exporter
Added support for bash and zsh autocompletion
Added support for calling tctl alert commands remotely
Added support for ElastiCache Redis IAM authentication
Extended Proxy Templates support to tsh ssh

5 details in Everything

v11.3.12 May 30, 2023 · release notes

Adds tbot pprof diagnostics endpoints and tsh fido2 attobj debug command

└──▷ GET THIS VERSION

$ git clone --branch v11.3.12 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.12

Adds pprof diagnostic endpoints to the tbot Machine ID agent for profiling and troubleshooting.
Adds tsh fido2 attobj subcommand to output FIDO2 attestation objects for debugging authentication flows.

2 details in Everything

v12.4.5 May 26, 2023 · release notes

Teleport v12.4.5 adds tsh ssh support in Proxy Templates and remote tctl alert execution.

└──▷ GET THIS VERSION

$ git clone --branch v12.4.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.5

└──▷ TRY IT

Execute tctl alert commands against a remote Teleport cluster without local agent connectivity.

$ tctl --auth-server=remote.example.com alert list

Added remote execution capability to the tctl alert CLI command.

1 detail in Everything

v13.0.3 May 25, 2023 · release notes

Teleport v13.0.3 adds OpenSSH certificate rotation, hostname support for nodes, and Kubernetes Operator ProvisionToken

└──▷ GET THIS VERSION

$ git clone --branch v13.0.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.0.3

Added ProvisionToken support to the Kubernetes Operator
Added certificate rotation support to teleport join openssh command
Added support for using hostnames in OpenSSH node resources in addition to IPs
Extended kubectl auth can-i support to consider kubernetes_resources RBAC rules

4 details in Everything

v13.0.2 May 17, 2023 · release notes

Teleport v13.0.2 adds tsh fido2 attobj, tctl alerts ls --format, trace logging, GCP IAM joining, and ALB single-port support.

└──▷ GET THIS VERSION

$ git clone --branch v13.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.0.2

└──▷ USE IT

Join a Kubernetes cluster using the new single-port ALB method.

shell

tsh kube join --role=editor --alias=my-cluster:default

Parse a FIDO attestation object using the new debug subcommand.

shell

tsh fido2 attobj <attestation_object_base64>

Export alerts in a machine-readable format for CI/CD integration.

shell

tctl alerts ls --format=json > alerts.json

Adds tsh kube join in single-port mode behind ALB
Adds tsh request search --kind=pod in single-port mode behind ALB
Adds --format flag to tctl alerts ls command
Adds new tsh fido2 attobj debug command to parse FIDO attestation objects
Adds GCP IAM joining method for Kubernetes access

+4 more show less

Adds ability to enable trace logging level for performance diagnostics
Adds support for YubiHSM2 SDK version 2023.01
Adds pprof diagnostics endpoints to tbot
Adds audit events for Okta integration

9 details in Everything

v12.4.2 May 17, 2023 · release notes

Teleport v12.4.2 introduces Teleport Assist preview and adds tctl/tsh capabilities

└──▷ GET THIS VERSION

$ git clone --branch v12.4.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.4.2

└──▷ USE IT

Export alerts to JSON format for automated processing or integration with external ticketing systems.

shell

tctl alerts ls --format json

Diagnose FIDO2 device registration issues by inspecting the attestation object structure directly via CLI.

shell

tsh fido2 attobj --attestation <base64_encoded_att_obj>

Introduces Teleport Assist, a GPT-4 powered chat assistant for executing commands on servers (Teleport Cloud Team plan only).
Adds --format flag to tctl alerts ls command.
Includes acknowledged alerts in verbose mode (-v) for tctl alerts ls.
Adds tsh fido2 attobj debug subcommand to parse FIDO2 attestation objects.
Adds pprof diagnostics endpoints to tbot (Machine ID).

+3 more show less

Adds audit events for Okta integration.
Enables trace logging level.
Adds support for YubiHSM2 SDK version 2023.01.

8 details in Everything

v12.3.3 May 9, 2023 · release notes

Adds new AWS integration and RDS database enrollment flow in the Access Management UI.

└──▷ GET THIS VERSION

$ git clone --branch v12.3.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.3.3

└──▷ HOW TO FIND IT

Enroll Amazon RDS databases for access via the Teleport Access Management UI.

📍Navigate to Access Management › AWS Integration and follow the new RDS enrollment flow in the Web UI.

v13.0.0 May 9, 2023 · release notes

Teleport 13 adds OpenSSH node registration, automatic agent upgrades (Preview), Okta import for Apps (Preview), AWS OpenSearch DB support, moderated SFTP, desktop recording export, and more.

└──▷ GET THIS VERSION

$ git clone --branch v13.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v13.0.0

└──▷ TRY IT

Export a Windows desktop session recording to video for offline review

$ tsh recordings export <session_id> --output=recording.mp4

Set MFA requirement using the new numeric mode values in a Terraform resource

hcl

resource "teleport_auth_preference" "default" {
  spec {
    require_session_mfa = 2 # Per-session MFA with hardware key
  }
}

Adds native resource support for OpenSSH nodes, enabling tsh ls output and Web UI visibility with RBAC control
(Preview) Enables automatic upgrades for agents deployed via apt/yum or Helm chart
(Preview, Enterprise-only) Adds Okta integration to import applications and groups into Application Access
(Preview) Adds AWS OpenSearch as a supported database type for Database Access
Adds tsh recordings export command to export Windows desktop session recordings to video format

+2 more show less

Adds SFTP file transfer capability within Moderated Sessions
Adds single-port TLS routing support for Server, Kubernetes, and Application Access behind ALBs

7 details in Everything

└──▷ BREAKING ON UPGRADE

!require_session_mfa field in teleport_auth_preference and teleport_role resources now accepts a number (0-3) instead of a boolean
!Default session join mode for SSH and Kubernetes sessions is now observer mode; use --mode flag with tsh join to override
!tctl auth rotate --type=all is removed; the type flag is now required
!Tokens created via YAML resource files no longer have a default 30-minute expiry; set metadata.expires explicitly
!CreateToken and UpsertToken RPCs are deprecated in favor of CreateTokenV2 and UpsertTokenV2 in the API module

v12.3.0 May 2, 2023 · release notes

Adds support for automatic Windows user creation in Desktop Access.

└──▷ GET THIS VERSION

$ git clone --branch v12.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.3.0

v12.2.5 Apr 28, 2023 · release notes

Adds --set-context flag to tsh kube login to override the default Kubernetes context name

└──▷ GET THIS VERSION

$ git clone --branch v12.2.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.2.5

└──▷ USE IT

Login to a Kubernetes cluster and explicitly name the resulting kubeconfig context for easier identification.

shell

tsh kube login --set-context=my-custom-context <cluster>

v11.3.11 Apr 21, 2023 · release notes

Adds --raw flag to teleport version, discovery_group for discovery service, and wider AWS DB support in teleport db configure

└──▷ GET THIS VERSION

$ git clone --branch v11.3.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.11

Adds --raw flag to the teleport version CLI command for machine-parseable output.
Adds discovery_group configuration key to the discovery service to prevent race conditions between multiple services.
Expands teleport db configure to support additional AWS database engines.

3 details in Everything

v10.3.16 Apr 21, 2023 · release notes

Adds --raw flag to teleport version, per-session MFA in connection testers, and faster proxy peering reconnects

└──▷ GET THIS VERSION

$ git clone --branch v10.3.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.16

└──▷ USE IT

Get the version string for automated parsing or CI checks without manual cleanup.

shell

teleport version --raw

Test connectivity to a resource requiring MFA, enabling per-session challenges in the Web UI.

📍In the Teleport Web UI, open the connection tester and look for the option to enable per-session MFA before initiating the connection.

Adds --raw flag to teleport version command for machine-readable output
Adds per-session MFA support to Web UI connection testers
Improves agent reconnect speed in proxy peering mode

3 details in Everything

v12.2.4 Apr 20, 2023 · release notes

Teleport v12.2.4 adds --raw flag to teleport version, discovery group config, and improved tsh scp reliability

└──▷ GET THIS VERSION

$ git clone --branch v12.2.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.2.4

└──▷ TRY IT

Get a clean version string for scripting or CI checks without parsing headers.

$ teleport version --raw

Configure auto-discovery to group resources into specific discovery sets.

text

discovery_group: my-aws-cluster-group

Adds --raw flag to the teleport version CLI command to output a single version string without formatting.
Adds ability to specify a discovery_group for auto-discovery services via configuration.
Improves error reporting from tsh scp when file copying is disabled on the server.

3 details in Everything

v11.3.10 Apr 5, 2023 · release notes

Teleport v11.3.10 adds --cluster to tsh kube sessions, app_server support in tctl, memory backend CLI params, and TLS routing for AMIs.

└──▷ GET THIS VERSION

$ git clone --branch v11.3.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.10

└──▷ USE IT

Filter tsh kube sessions output to show only sessions for a specific cluster.

shell

tsh kube sessions --cluster=k8s-prod

Manage app_server resources (e.g., list all configured application access entries) via the CLI.

shell

tctl get app_server --format=json

Adds --cluster flag to tsh kube sessions to filter session listings by Kubernetes cluster
Adds app_server resource type support to tctl resource commands (create, get, update, delete)
Adds CLI parameters to specify the memory backend for Machine ID agent
Adds ability to configure TLS routing mode in AMIs deployment scripts

4 details in Everything

v10.3.15 Apr 5, 2023 · release notes

Teleport v10.3.15 adds tsh --version-only, app_server resource support, tsh kube sessions --cluster, per-session MFA for connection testers, and TLS routing config for AMIs.

└──▷ GET THIS VERSION

$ git clone --branch v10.3.15 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.15

└──▷ TRY IT

Check the Teleport binary version programmatically in scripts without parsing full output.

$ tsh --version-only

Query only app_server resources using tctl get, extending resource filtering capabilities.

$ tctl get app_server

List sessions for a specific leaf cluster when managing multi-cluster environments.

$ tsh kube sessions --cluster=leaf-cluster-1

tsh now has a --version-only flag to display only the binary version
tctl resource commands now support the app_server resource type
tsh kube sessions gains a --cluster flag to specify the target cluster
Connection testers in Access Management now support per-session MFA
AWS AMI provisioner supports configuring TLS routing mode

5 details in Everything

v12.2.1 Apr 5, 2023 · release notes

Teleport v12.2.1 adds headless SSO to tsh commands, Oracle DB support, IP pinning, and Helm imagePullSecrets.

└──▷ GET THIS VERSION

$ git clone --branch v12.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.2.1

└──▷ TRY IT

Deploy Teleport with private registry credentials using the new Helm value.

$ helm install teleport-gravitational/teleport-cluster --set "imagePullSecrets={my-secret}"

tsh ls, tsh ssh, and tsh scp now support headless SSO flows
Added Oracle database as a supported target for Database Access
IP pinning is now available for Kubernetes and Database Access
Teleport Helm chart teleport-cluster supports the imagePullSecrets field

4 details in Everything

v12.1.5 Apr 1, 2023 · release notes

v12.1.5 adds provision tokens for Bootstrap, AMI TLS routing, ALB App Access, tsh kube sessions --cluster, Gitlab/Azure delegated joining for Machine ID and FIPS support.

└──▷ GET THIS VERSION

$ git clone --branch v12.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.1.5

Adds provision token support to the Bootstrap subsystem, enabling unattended cluster bootstrapping.
Adds TLS routing mode configuration support for Amazon Machine Images (AMIs).
Enables application access behind an Application Load Balancer (ALB).
Adds ability to specify a command to run via the AWS tsh proxy.
Adds app_server resource type support to tctl CLI commands.

+7 more show less

Adds --cluster flag to the tsh kube sessions subcommand to filter sessions by cluster.
Enables provisioning Machine ID agents from Azure and Gitlab via delegated joining.
Allows configuring Memory backend parameters for Machine ID directly via CLI flags.
Adds FIPS-compliant mode support to Machine ID components.
Supports trusted cluster configuration for Machine ID.
Introduces distroless container images for the Teleport server runtime.
Enables setting resource limits and requests for pre-deployment Helm jobs.

12 details in Everything

v12.1.1-passwordless-windows Mar 24, 2023 · release notes

Adds passwordless login to non-domain-joined Windows desktops

└──▷ GET THIS VERSION

$ git clone --branch v12.1.1-passwordless-windows https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.1.1-passwordless-windows

v12.1.1 Mar 14, 2023 · release notes

New capability to export database CA in DER format via tctl auth export

└──▷ GET THIS VERSION

$ git clone --branch v12.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.1.1

└──▷ USE IT

Export the root CA in DER binary format for systems requiring raw certificate files.

shell

tctl auth export --type=db-ca --format=der > ca.der

v11.3.6 Mar 8, 2023 · release notes

Adds tctl alert ack command, --trace-profile flag to tsh, and AP-Southeast-4 IAM joining support

└──▷ GET THIS VERSION

$ git clone --branch v11.3.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.6

└──▷ TRY IT

Acknowledge an existing alert to silence notifications and clear the UI warning.

$ tctl alert ack <alert_id>

Capture a trace profile for troubleshooting tsh performance or connection issues.

$ tsh --trace-profile=/tmp/trace.prof login my-cluster

Adds the tctl alert ack subcommand to acknowledge alerts of any severity
Adds --trace-profile flag to tsh to generate runtime trace profiles
Adds support for IAM joining in the ap-southeast-4 region

3 details in Everything

v12.1.0 Mar 7, 2023 · release notes

Adds SAML IdP capability to Teleport Enterprise

└──▷ GET THIS VERSION

$ git clone --branch v12.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.1.0

v12.0.5 Mar 3, 2023 · release notes

New Azure VM integration capabilities and tsh --trace-profile flag

└──▷ GET THIS VERSION

$ git clone --branch v12.0.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.0.5

└──▷ USE IT

Generate a runtime trace for debugging tsh connection issues

shell

tsh --trace-profile=/tmp/trace.prof login my-cluster

Configure the proxy to store more web terminal history

yaml

# In your Teleport proxy config.yaml:
auth_service:
  web_terminal_scrollback: 10000

Added IAM joining support for Azure VMs to automate cluster node onboarding
Added auto-discovery support for Azure VMs to automatically register cloud resources
Added --trace-profile flag to tsh to generate runtime trace profiles for debugging
Added ability to specify web terminal scrollback length in proxy config

4 details in Everything

v11.3.5 Feb 28, 2023 · release notes

Teleport v11.3.5 adds Kubernetes join method, --client flag to tsh version, and resource selection bulk action

└──▷ GET THIS VERSION

$ git clone --branch v11.3.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.5

Adds kubernetes as a new auth connector type for joining clusters via Kubernetes ServiceAccount tokens
Adds --client flag to tsh version to display only the local client version string
Enables bulk selection when creating resource access requests through the UI
Adds new Prometheus metrics for active connection tracking

4 details in Everything

v12.0.4 Feb 27, 2023 · release notes

Teleport v12.0.4 adds tctl Device Trust resource commands, role assumption in tsh proxy aws, and device lock support.

└──▷ GET THIS VERSION

$ git clone --branch v12.0.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.0.4

v10.3.13 Feb 21, 2023 · release notes

Teleport v10.3.13 adds multi-transformation role templates, Helm chart improvements, and tsh authentication refinements.

└──▷ GET THIS VERSION

$ git clone --branch v10.3.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.13

Added support for multiple transformations in role templates
Added PodMonitor support in Helm charts
Added dnsConfig support in teleport-kube-agent chart
Added nodeSelector field to teleport-kube-agent chart
Updated tsh to respect --auth and --mfa-mode before defaulting to passwordless

5 details in Everything

└──▷ BREAKING ON UPGRADE

!tsh db connect now explicitly requires the --db-user flag for ElasticSearch

v12.0.2 Feb 13, 2023 · release notes

Teleport v12.0.2 adds pod request search and dynamic resource matching flag

└──▷ GET THIS VERSION

$ git clone --branch v12.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.0.2

└──▷ TRY IT

Search for all pending pod access requests in the cluster.

$ tsh request search --kind=pod

Configure a database connection that dynamically matches resources by name.

$ tsh db configure create --resource-name-pattern='prod-.*'

Adds --kind=pod support to the tsh request search CLI command
Makes --resource-name-pattern required in tsh db configure create for dynamic resources

2 details in Everything

└──▷ BREAKING ON UPGRADE

!The tsh db configure create command now fails if --resource-name-pattern is omitted when configuring dynamic resources.

v12.0.1 Feb 7, 2023 · release notes

Teleport v12 adds tsh az/tsh gcloud, Device Trust preview, per-pod RBAC, new DB integrations, tctl edit subcommand.

└──▷ GET THIS VERSION

$ git clone --branch v12.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.0.1

└──▷ USE IT

Edit a Teleport role directly in your editor

shell

tctl edit role admin-role

Adds tsh az and tsh gcloud CLI commands for Azure and GCP Application Access (Preview)
Adds Device Trust preview for macOS using Secure Enclave authentication
Adds per-pod RBAC capability to Kubernetes Access for controlling individual pod access
Adds AWS DynamoDB, AWS Redshift Serverless, and AWS RDS Proxy integrations to Database Access
Adds Azure SQLServer Auto Discovery and Azure Flexible Server support in Database Access

+4 more show less

Refactors the teleport-cluster Helm chart with separate Proxy/Auth deployments and a scratch mode (Preview)
Drops support for SHA1 algorithms in Server Access, removing the need for PubAcceptedKeyTypes workarounds
Adds tctl edit subcommand for editing resources in a text editor
Enables signed/notarized macOS binaries to eliminate untrusted software warnings

9 details in Everything

└──▷ BREAKING ON UPGRADE

!The teleport-cluster Helm chart no longer supports upgrading from custom mode without following the migration guide at https://goteleport.com/docs/ver/12.x/deploy-a-cluster/helm-deployments/migration-v12/
!PSPs are removed from the Helm chart when installing on Kubernetes 1.23 and higher
!tctl auth export only exports the private key when passing the --keys flag; previously it output both certificate and private key
!Windows Desktop sessions disable the wallpaper by default; restore previous behavior by setting show_desktop_wallpaper: true in windows_desktop_service config
!Kubernetes Access roles migrating to RoleV6 must explicitly include kubernetes_resources with kind: pod, name: '*', and namespace: '*'

v12.0.0-passwordless-windows Feb 6, 2023 · release notes

Enables passwordless login to Windows desktops not joined to an Active Directory domain

└──▷ GET THIS VERSION

$ git clone --branch v12.0.0-passwordless-windows https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v12.0.0-passwordless-windows

v11.3.1 Jan 30, 2023 · release notes

Adds Login Rules for SSO users, PodMonitor support in Helm charts, nodeSelector field, and raw config pass-through.

└──▷ GET THIS VERSION

$ git clone --branch v11.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.3.1

Adds LoginRules to allow administrators to define access policies specifically for SSO users
Adds podMonitor section to the teleport-cluster Helm chart to enable Prometheus Pod monitoring out-of-the-box
Adds nodeSelector field to the teleport-cluster Helm chart allowing pods to be scheduled on specific nodes
Adds support for passing raw configuration values to teleport-kube-agent via a new Helm value
Adds clientIdleTimeoutMessage support for Windows access sessions

+1 more show less

Enables acknowledging alerts within the Teleport platform

6 details in Everything

v11.2.3 Jan 24, 2023 · release notes

Teleport v11.2.3 adds multiple role template transformations, Trusted Cluster role mapping updates, and dnsConfig to the Helm chart.

└──▷ GET THIS VERSION

$ git clone --branch v11.2.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.2.3

dnsConfig support added to the teleport-kube-agent Helm chart
Multiple transformations now supported in role templates
Trusted Cluster role mappings can be updated without recreating the cluster

3 details in Everything

v10.3.12 Jan 18, 2023 · release notes

Adds tsh traces export for unconfigured Auth Servers and periodic TLS cert reloading to the proxy.

└──▷ GET THIS VERSION

$ git clone --branch v10.3.12 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.12

Adds the ability to export tsh traces even when the Auth Server is not configured for tracing
Added support for periodically reloading the proxy's TLS certificates
Upated tsh to set extra proxy headers in all HTTP requests

3 details in Everything

v9.3.26 Jan 14, 2023 · release notes

Adds certificate expiry support for bot joins, secure cert mapping for Windows desktop certs, and tsh trace export without Auth Server tracing.

└──▷ GET THIS VERSION

$ git clone --branch v9.3.26 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.26

gcp.credentialSecretName is now optional in the Teleport Cluster Helm chart
Supports secure certificate mapping for Windows desktop certificates
Export tsh traces even when the Auth Server is not configured for tracing

3 details in Everything

v11.2.1 Jan 11, 2023 · release notes

Teleport v11.2.1 adds automatic proxy TLS cert reloading and fixes IAM joining for bots

└──▷ GET THIS VERSION

$ git clone --branch v11.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.2.1

Added support for periodically reloading the proxy's TLS certificates
Improved desktop certificate generation by using the proper field for querying a user's SID
Updated the web UI to hide the trusted clusters screen for users who lack the appropriate role

3 details in Everything

v11.2.0 Jan 7, 2023 · release notes

Teleport v11.2.0 adds Machine ID GitHub Actions support and required sid config for secure Windows certificate mapping.

└──▷ GET THIS VERSION

$ git clone --branch v11.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.2.0

gcp.credentialSecretName is now optional in the Teleport Cluster Helm chart
New audit event for DynamoDB requests via Application Access
Added rate limiting to SAML/OIDC routes
Export tsh traces when Auth Server tracing is disabled
Add suggested reviewers and requestable roles to Teleport Connect access requests

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Windows Desktop Access now requires a sid field in LDAP configuration; omitting it breaks secure certificate mapping.

v11.1.4 Dec 23, 2022 · release notes

Teleport v11.1.4 adds instance/bot join audit events and configurable Access Request TTLs.

└──▷ GET THIS VERSION

$ git clone --branch v11.1.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.1.4

Adds new instance.join and bot.join audit events to track service account initialization
Adds the ability to supply Access Request TTLs via configuration

2 details in Everything

v9.3.23 Dec 6, 2022 · release notes

Teleport v9.3.23 adds moderated session filters (user.spec), Windows desktop resource type, and ARM container images

└──▷ GET THIS VERSION

$ git clone --branch v9.3.23 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.23

└──▷ TRY IT

Query for Windows Desktop resources using the new resource type name in tctl commands.

$ tctl get windows_desktops

LimitNOFILE added to all systemd unit files to allow configuring open file limits for Teleport services
Adds windows_desktops as a valid resource name for tctl resource commands
Added support for arm and arm64 container images

3 details in Everything

v10.3.9 Dec 2, 2022 · release notes

Teleport v10.3.9 adds user.spec support in moderated session filters and windows_desktop resource name in tctl.

└──▷ GET THIS VERSION

$ git clone --branch v10.3.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.9

Adds user.spec syntax support to moderated session filters for finer-grained access control based on user specification.
Updates tctl to recognize and manage the new windows_desktop resource name, enabling configuration of Windows desktop resources via CLI.

2 details in Everything

v11.1.1 Dec 1, 2022 · release notes

Teleport v11.1.1 adds Cloud HSM support on Google Cloud and new audit fields

└──▷ GET THIS VERSION

$ git clone --branch v11.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.1.1

└──▷ HOW TO FIND IT

Use the new web UI feature to request access with specific roles without using CLI.

📍In the web console, go to Access Requests › New Request and select target roles in the dropdown.

Adds server_hostname field to session.* audit events for deeper session tracking
Enables specifying roles during access requests directly in the web UI

2 details in Everything

v11.1.0 Nov 29, 2022 · release notes

Teleport v11.1.0 adds teleport discovery bootstrap, self-hosted GitHub Enterprise SSO, and desktop trusted clusters.

└──▷ GET THIS VERSION

$ git clone --branch v11.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.1.0

└──▷ TRY IT

Bootstrap discovery agents automatically for the current cluster.

$ teleport discovery bootstrap

Manage Windows desktop resources in RBAC rules or via tctl CLI.

$ tctl get windows_desktops

Filter moderated sessions using the new user.spec syntax.

text

user.spec: "(name == 'admin' && groups.contains('dev'))"

Adds windows_desktops as the valid resource type for tctl commands (replacing previous names).
Adds teleport discovery bootstrap subcommand to automate initial discovery configuration.
Adds support for self-hosted GitHub Enterprise SSO connectors in Teleport Enterprise edition.
Adds audit events for DynamoDB access performed via the AWS CLI.
Adds auth connector support within the Kubernetes Operator.

+4 more show less

Adds audit events for Desktop Access directory sharing sessions.
Adds trusted cluster support specifically for Desktop Access resources.
Adds user.spec syntax support in moderated session filters for more precise role matching.
Adds GKE auto-discovery capability to Kubernetes Access, reducing manual configuration.

9 details in Everything

v10.3.8 Nov 17, 2022 · release notes

Adds ARM container images and role selection for resource access requests

└──▷ GET THIS VERSION

$ git clone --branch v10.3.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.8

Added arm and arm64 container images
Added ability to select specific roles when creating a resource access request

2 details in Everything

v11.0.3 Nov 15, 2022 · release notes

Teleport v11.0.3 adds Machine ID CircleCI support, ARM Docker images, and RDS Proxy for PostgreSQL/MySQL

└──▷ GET THIS VERSION

$ git clone --branch v11.0.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.0.3

Adds CircleCI support to Machine ID integration for automated credential provisioning
Adds arm and arm64 Docker image architectures for Teleport and Operator
Adds PostgreSQL and MySQL RDS Proxy support in database access configuration

3 details in Everything

v10.3.4 Oct 27, 2022 · release notes

Teleport v10.3.4 adds load_all_cas auth service option and blocks SFTP in moderated sessions.

└──▷ GET THIS VERSION

$ git clone --branch v10.3.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.4

Adds the load_all_cas auth service config key to load all CAs when connecting to a node.
Blocks SFTP protocol usage within Moderated Sessions.

2 details in Everything

v11.0.0 Oct 24, 2022 · release notes

Teleport v11 introduces Hardware-backed keys, SFTP protocol, EKS/AKS auto-discovery, Cassandra support, and MFA via Windows Hello

└──▷ GET THIS VERSION

$ git clone --branch v11.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v11.0.0

└──▷ HOW TO FIND IT

Enable hardware-backed key storage on a Yubikey for tsh Server Access authentication

📍# Configuration is typically done via the guide referenced in release notes; # ensure yubikey is connected and follow https://goteleport.com/docs/access-controls/guides/hardware-key-support/

Configure Terraform OIDC connector to use the new array format for redirect URLs

hcl

resource "teleport_oidc_connector" "example" {
  name        = "my-oidc"
  display_name = "My OIDC Provider"
  redirect_url = [ "http://example.com/callback" ]
}

Use the new Teleport Terraform plugin resource to create a Machine ID Bot

hcl

resource "teleport_machine_id_bot" "example_bot" {
  name       = "automation-bot"
  roles      = [ "editor" ]
}

Adds tsh support for hardware-backed private keys on Yubikey devices for Server Access (Enterprise only)
Replaces obsolete SCP with SFTP protocol for Server Access file transfers in Teleport clients and adds server-side SFTP support
Removes persistent storage requirement for Helm charts by storing identities in Kubernetes Secrets and switching to StatefulSet
Adds automatic discovery and enrollment of AWS EKS and Azure AKS clusters for Kubernetes Access
Adds auto-discovery for Azure-hosted PostgreSQL and MySQL databases in Database Access

+6 more show less

Adds support for Azure AD managed identity authentication for Azure-hosted SQL Server databases
Adds Cassandra, ScyllaDB, and AWS Keyspaces support for Database Access
Adds secret-less joining of Machine ID agents in GitHub Actions workflows via a new Teleport Actions repository
Extends the Teleport Terraform plugin to support creation of Machine ID Bots and Bot Tokens
Adds MFA and passwordless login support for tsh on Windows via Windows Hello and FIDO2 devices
Adds Access Requests and file upload/download support in the Teleport Connect UI

11 details in Everything

└──▷ BREAKING ON UPGRADE

!GitHub SAML SSO is only available in Enterprise Edition; OSS Teleport requires disabling GitHub SAML SSO to use GitHub SSO with Free/Team plans
!The redirect_url property in Terraform OIDC connectors now expects an array format instead of a string
!Quay.io container registry support is deprecated and will be removed in a future release; customers must migrate to AWS ECR
!Old deb/rpm repositories (deb.releases.teleport.dev and rpm.releases.teleport.dev) are deprecated in favor of apt.releases.teleport.dev and yum.releases.teleport.dev
!The teleport-kube-agent Helm chart now deploys agents as StatefulSet instead of Deployment, removing the need for persistent storage
!The preview PostgreSQL backend has been removed
!Desktop Access support for 32-bit ARM and 386 architectures has been removed

v10.3.3 Oct 20, 2022 · release notes

Teleport v10.3.3 adds license expiration alerts and expands the teleport-kube-agent Helm chart with imagePullSecret and join parameter support.

└──▷ GET THIS VERSION

$ git clone --branch v10.3.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.3

v10.3.2 Oct 13, 2022 · release notes

Adds username_claim config field for OIDC and improves tsh app login curl output.

└──▷ GET THIS VERSION

$ git clone --branch v10.3.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.2

└──▷ USE IT

Run tsh app login and copy the generated curl command to interact with the application securely.

shell

tsh app login my-app -- curl https://my-app.internal

v10.3.1 Oct 1, 2022 · release notes

Adds Elasticsearch support to Database Access and Kubernetes Access support in Teleport Connect

└──▷ GET THIS VERSION

$ git clone --branch v10.3.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.3.1

Added Elasticsearch support to Database Access
Added information about available security releases to tsh status

2 details in Everything

v9.3.21 Sep 28, 2022 · release notes

Teleport v9.3.21 adds allow_unverified_email OIDC setting and memory improvements

└──▷ GET THIS VERSION

$ git clone --branch v9.3.21 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.21

v10.2.6 Sep 27, 2022 · release notes

Teleport v10.2.6 adds simplified Active Directory configuration for Desktop Access

└──▷ GET THIS VERSION

$ git clone --branch v10.2.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.2.6

v10.2.4 Sep 26, 2022 · release notes

Teleport v10.2.4 adds EC2 instance discovery, allow_unverified_email OIDC param, TLS routing for DB Access via ALB, and Helm chart updates

└──▷ GET THIS VERSION

$ git clone --branch v10.2.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.2.4

Adds minReadySeconds setting to the teleport-cluster Helm chart
Adds support for automatic EC2 instance discovery and enrollment
Adds allow_unverified_email parameter to OIDC connectors to opt out of email verification
Adds support for TLS routing for Database Access when Teleport is deployed behind an ALB
Adds support for providing custom CAs to the teleport-cluster Helm chart

5 details in Everything

v10.2.2 Sep 17, 2022 · release notes

Adds tctl alerts create subcommand for custom alerts and EC2 joining for Windows Desktop Service

└──▷ GET THIS VERSION

$ git clone --branch v10.2.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.2.2

v9.3.20 Sep 16, 2022 · release notes

New SessionRecordingAccess audit event, RDP licensing negotiation, and SFTP audit events in v9.3.20

└──▷ GET THIS VERSION

$ git clone --branch v9.3.20 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.20

Added SessionRecordingAccess audit event emitted every time session events are queried or streamed
Added support for RDP licensing negotiation in Desktop Access
Added SFTP audit events to track file transfer activities

3 details in Everything

v8.3.18 Sep 9, 2022 · release notes

Teleport v8.3.18 adds teleport install systemd command, IAM joining in AWS China regions, and GovCloud console access.

└──▷ GET THIS VERSION

$ git clone --branch v8.3.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.3.18

Adds teleport install systemd subcommand that generates a systemd unit file for Teleport services
Adds support for IAM joining of cluster nodes in AWS China regions
Adds SessionRecordingAccess event type emitted when session events are queried or streamed
Adds lock_target field to lock.create audit events

4 details in Everything

v10.2.0 Sep 7, 2022 · release notes

New features: session events to auditd, Azure DB auto-discovery, Desktop dir sharing, tsh login version alerts.

└──▷ GET THIS VERSION

$ git clone --branch v10.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.2.0

Added support for sending session events to Linux Audit System (auditd).
Added support for Azure PostgreSQL and MySQL databases auto-discovery.
Added support for directory sharing to Desktop Access.
Added new Teleport version notifications to tsh login and tsh status.
Added --browser=none support to tctl sso test command that prints the URL in the console.

5 details in Everything

v10.1.9 Aug 31, 2022 · release notes

Teleport v10.1.9 adds ssh_file_copy role option, tsh alias subcommands, and AWS China/GovCloud support.

└──▷ GET THIS VERSION

$ git clone --branch v10.1.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.1.9

Adds ssh_file_copy role option allowing to disable scp and SFTP file copying
Added ssh_file_copy role option allowing to disable scp and SFTP file copying
Added ability to disable local auth in teleport-cluster Helm chart.
Added support for tsh alias subcommands.
Added support for AWS China and GovCloud regions to Database Access.

5 details in Everything

v9.3.18 Aug 23, 2022 · release notes

Teleport v9.3.18 adds teleport install systemd subcommand and variable playback speed for Desktop Access recordings.

└──▷ GET THIS VERSION

$ git clone --branch v9.3.18 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.18

└──▷ TRY IT

Install Teleport as a systemd service for managed lifecycle control.

$ teleport install systemd -d /etc/teleport

Change playback speed while reviewing a Desktop Access session recording via the web console.

📍In the Teleport Console, open a recorded Desktop Access session and use the speed control slider to adjust playback rate.

teleport install systemd allows installing Teleport as a systemd service on supported platforms
Desktop Access session recordings now support variable playback speed in the web UI

2 details in Everything

v8.3.17 Aug 22, 2022 · release notes

Adds SFTP subsystem support to Teleport

└──▷ GET THIS VERSION

$ git clone --branch v8.3.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.3.17

Added SFTP subsystem support.
Improved parsing logic for second_factor config option.

2 details in Everything

v10.1.4 Aug 15, 2022 · release notes

Adds tsh recordings ls, teleport install systemd, proxy protocol support, login traits for Machine ID bots, and Helm chart controls.

└──▷ GET THIS VERSION

$ git clone --branch v10.1.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.1.4

Adds tsh recordings ls command that displays available session recordings
Adds teleport install systemd command that installs Teleport as a systemd service
Added proxy protocol support to the SSH proxy endpoint
Added ability to control session recording mode in teleport-cluster Helm chart
Added ability to control DynamoDB auto-scaling in teleport-cluster Helm chart

+2 more show less

Added variable playback speed to Desktop Access session recordings
Updated tctl users update command to allow setting additional user traits

7 details in Everything

v9.3.14 Aug 2, 2022 · release notes

Adds SFTP subsystem support to Teleport

└──▷ GET THIS VERSION

$ git clone --branch v9.3.14 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.14

v10.1.2 Aug 2, 2022 · release notes

Teleport v10.1.2 adds Machine ID for Kubernetes/App Access, new tsh request drop command, and Prometheus metrics for S3/DynamoDB.

└──▷ GET THIS VERSION

$ git clone --branch v10.1.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.1.2

Adds Machine ID support for Kubernetes Access (Preview)
Adds Machine ID support for Application Access (Preview)
Adds plain TCP applications support for Application Access (Preview)
Adds Prometheus metrics for S3 requests
Adds Prometheus metrics for DynamoDB requests

5 details in Everything

v9.3.13 Jul 27, 2022 · release notes

Teleport v9.3.13 adds tsh proxy db direct mode, AWS external IDs, and DynamoDB metrics.

└──▷ GET THIS VERSION

$ git clone --branch v9.3.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.13

Adds the teleport.dev/database_name tag to override the AWS database name for session uploads
Enables tsh proxy db without requiring a prior tsh db login call
Adds support for external IDs in AWS Console access configurations
Adds additional Prometheus metrics for DynamoDB monitoring

4 details in Everything

v8.3.16 Jul 27, 2022 · release notes

Adds AWS database name tag support, tsh proxy db direct mode, and external IDs for AWS Console Access in v8.3.16

└──▷ GET THIS VERSION

$ git clone --branch v8.3.16 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.3.16

└──▷ USE IT

Connect directly to a database proxy via TSH without performing a separate login step first.

shell

tsh proxy db --db-user=dbadmin --db-name=postgres my-cluster

Added ability to set AWS database name via teleport.dev/database_name tag
Added ability to call tsh proxy db without tsh db login
Added support for external IDs in AWS Console Access

3 details in Everything

v9.3.12 Jul 20, 2022 · release notes

Teleport v9.3.12 allows configuring session recording via resource definitions

└──▷ GET THIS VERSION

$ git clone --branch v9.3.12 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.12

Added ability to set session recording configuration from a resource

1 detail in Everything

v10.0.1 Jul 15, 2022 · release notes

Teleport v10.0.1 adds CA rotation for Machine ID, --format flag to tsh proxy aws, and users update --set-logins.

└──▷ GET THIS VERSION

$ git clone --branch v10.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.0.1

└──▷ TRY IT

Scan AWS accounts using Teleport and output the credentials in a specific format for integration with other tools.

$ tsh proxy aws --format=json

Added CA rotation support to Machine ID
Added --format flag to tsh proxy aws command

2 details in Everything

v10.0.0 Jul 8, 2022 · release notes

Teleport 10 introduces Passwordless auth, Proxy Peering config, Snowflake/ElastiCache support, and skips version check.

└──▷ GET THIS VERSION

$ git clone --branch v10.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v10.0.0

auth_service.tunnel_strategy.type allows configuring proxy_peering to decouple agent connection counts from proxy scale
proxy_service.peer_listen_addr exposes the port for neighboring proxies to tunnel client connections via Proxy Peering
Passwordless authentication with resident credentials or built-in authenticators (e.g., Touch ID) for user login
Automatic Linux host user provisioning upon SSH login without PAM integration, configurable via documentation guide
Audit logging captures Microsoft SQL Server queries and prepared statements in the audit log

+3 more show less

tctl now supports Snowflake Database Access with role-based access control and query activity auditing
Machine ID supports Database Access for application-to-database connections via Teleport
New --skip-version-check flag allows Auth Service agents to bypass the major version drift check

8 details in Everything

└──▷ BREAKING ON UPGRADE

!tctl access ls command is removed; use a previous tctl version if you need user server access information
!Reverse tunnel connections now respect HTTP_PROXY environment variables, which may prevent re-establishment if the proxy is misconfigured
!GitHub connector's teams_to_logins field is deprecated in favor of teams_to_roles; the old field will be removed in a future release

v9.3.9 Jul 1, 2022 · release notes

Adds FIPS endpoints for S3/DynamoDB and CA pin via file path config

└──▷ GET THIS VERSION

$ git clone --branch v9.3.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.9

Added use_fips_endpoint connection option to enable FIPS endpoints for S3 and DynamoDB.
Added ability to specify CA pin as a file path in the config.

2 details in Everything

v9.3.7 Jun 22, 2022 · release notes

t9.3.7 adds tsh ls -R for listing resources across clusters and profiles

└──▷ GET THIS VERSION

$ git clone --branch v9.3.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.7

└──▷ USE IT

List all accessible resources in your multi-cluster environment at once.

shell

tsh ls -R

v9.3.6 Jun 15, 2022 · release notes

Adds Unicode clipboard support to Desktop Access sessions

└──▷ GET THIS VERSION

$ git clone --branch v9.3.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.6

v9.3.5 Jun 14, 2022 · release notes

Teleport v9.3.5 adds tsh proxy ssh -J support, security context in Helm charts, and reference AWS Terraform deployment for App/DB Access.

└──▷ GET THIS VERSION

$ git clone --branch v9.3.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.5

tsh proxy ssh -J flag enables jump host chaining compatible with OpenSSH syntax
securityContext field available in Teleport Helm charts for pod configuration
Reference AWS Terraform deployment resource now supports Application and Database Access

3 details in Everything

v9.3.4 Jun 9, 2022 · release notes

Teleport v9.3.4 adds automatic EC2 tag import, multiple OIDC redirect URLs, Proxy Protocol v2 for MySQL, and Windows desktop LDAP labeling

└──▷ GET THIS VERSION

$ git clone --branch v9.3.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.4

Adds automatic tag import from AWS EC2 metadata when nodes run on AWS.
Supports configuring multiple redirect_urls in OIDC connector definitions to handle callback variations.
Enables proxy_protocol: v2 configuration option for MySQL proxy instances to support load balancer health checks.
Adds LDAP attribute-based labeling for Windows desktops, allowing dynamic label assignment from AD attributes.

4 details in Everything

teleport-connect-preview-1.0.2 May 31, 2022 · release notes

Teleport Connect preview adds 5000-line terminal scrollback and keyboard shortcut tooltips.

└──▷ GET THIS VERSION

$ git clone --branch teleport-connect-preview-1.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout teleport-connect-preview-1.0.2

└──▷ HOW TO FIND IT

Learn keyboard shortcuts for common actions via on-screen prompts.

📍Hover over UI elements to reveal shortcut tooltips.

Increases terminal scrollback buffer to 5000 lines for better log visibility in cloud sessions
Adds tooltips displaying keyboard shortcuts to improve discoverability of commands

2 details in Everything

v9.3.0 May 28, 2022 · release notes

Machine ID gains database access support

└──▷ GET THIS VERSION

$ git clone --branch v9.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.3.0

└──▷ BREAKING ON UPGRADE

!Reduces the minimum GLIBC requirement to 2.18
!Enforces more secure cipher suites for desktop access, requiring additional configuration on Windows Server 2012R2 desktops

v9.2.4 May 20, 2022 · release notes

Adds tbot configure command and global /etc/tsh.yaml tsh config support

└──▷ GET THIS VERSION

$ git clone --branch v9.2.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.2.4

└──▷ USE IT

Initialize the configuration needed for a Teleport Bot to join the cluster.

shell

tbot configure --type bot --name my-bot

tbot configure command to generate Teleport Bot configuration.
Supports global tsh config file at /etc/tsh.yaml.

2 details in Everything

v8.3.11 May 19, 2022 · release notes

Adds /etc/tsh.yaml global config file support for tsh.

└──▷ GET THIS VERSION

$ git clone --branch v8.3.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.3.11

└──▷ USE IT

Apply tsh defaults (like cert formats or log levels) to all users and sessions on the host without requiring per-user configuration.

shell

# Place settings in the global config
sudo tee /etc/tsh.yaml > /dev/null <<EOF
log-level: info
cert-format: smart-protobuf
EOF

v9.2.3 May 13, 2022 · release notes

Adds --format flag to tctl token add, persistence/config support in Helm charts, and JWT header injection for App Access.

└──▷ GET THIS VERSION

$ git clone --branch v9.2.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.2.3

Added --format flag to tctl token add command
Added support for setting priority class and extra labels in Helm charts
Added support for persistency in custom mode in Helm charts
Added ability to inject App Access JWT tokens in rewritten headers

4 details in Everything

v9.2.1 May 5, 2022 · release notes

Teleport v9.2.1 adds max_kubernetes_connections role option and database cert support in Machine ID

└──▷ GET THIS VERSION

$ git clone --branch v9.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.2.1

Adds max_kubernetes_connections role option for limiting simultaneous Kubernetes connections
Adds support for database access certificates in Machine ID

2 details in Everything

v9.1.3 May 2, 2022 · release notes

Adds flags to teleport configure command

└──▷ GET THIS VERSION

$ git clone --branch v9.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.1.3

└──▷ TRY IT

Configure a Teleport cluster using new command-line flags.

$ teleport configure --help

v8.3.9 Apr 28, 2022 · release notes

Teleport v8.3.9 adds extra flags to the teleport configure command.

└──▷ GET THIS VERSION

$ git clone --branch v8.3.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.3.9

v8.3.8 Apr 22, 2022 · release notes

Teleport v8.3.8 adds tctl auth sign for DB credentials and updates tsh db ls output

└──▷ GET THIS VERSION

$ git clone --branch v8.3.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.3.8

Adds ability to sign database credentials with tctl auth sign
Updates tsh db ls to display available users

2 details in Everything

v9.1.0 Apr 21, 2022 · release notes

Teleport v9.1.0 introduces PostgreSQL/CockroachDB backend preview and JSON/YAML output for tsh commands.

└──▷ GET THIS VERSION

$ git clone --branch v9.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.1.0

└──▷ USE IT

Use JSON formatting for a tsh command to parse results programmatically.

shell

tsh --proxy=teleport.example.com --user=admin ls --format=json

Adds support for using PostgreSQL or CockroachDB as the auth server data store (preview).
Moves resource searching, filtering, and pagination to the server side for tsh, tctl, and the web UI.
Enables bookmarking searches in the web UI by including the query in the URL.
Adds authenticated tunnel mode to the tsh proxy db command.
Supports calling the Teleport proxy over plain HTTP when started in insecure mode.

+3 more show less

Adds optional gRPC client/server latency metrics.
Supports json and yaml formatting flags for all tsh commands.
Allows setting kubernetes_users, kubernetes_groups, db_names, db_users, and aws_role_arns traits during user creation.

8 details in Everything

v9.0.4 Apr 7, 2022 · release notes

Teleport v9.0.4 adds Proxy Protocol v2 support and a new teleport_connect_to_node_attempts_total Prometheus metric.

└──▷ GET THIS VERSION

$ git clone --branch v9.0.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.0.4

v8.3.5 Mar 28, 2022 · release notes

Adds HTTP_PROXY support to tsh, per-user tsh config preferences, and an automatic node joining wizard for OSS.

└──▷ GET THIS VERSION

$ git clone --branch v8.3.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.3.5

└──▷ TRY IT

Route tsh traffic through a corporate proxy server.

$ export HTTP_PROXY=http://proxy.example.com:8080; tsh login --proxy=teleport.example.com

v9.0.2 Mar 26, 2022 · release notes

Per-user tsh configuration preferences, role bootstrapping in OSS, and HTTP_PROXY support in tsh

└──▷ GET THIS VERSION

$ git clone --branch v9.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.0.2

Added support for per-user tsh configuration preferences.
Added support for role bootstrapping in OSS.
Added HTTP_PROXY support to tsh.

3 details in Everything

v9.0.0 Mar 11, 2022 · release notes

Teleport v9.0 adds Machine ID Preview, Desktop Access GA with clipboard/MFA, and new teleport db configure CLI commands

└──▷ GET THIS VERSION

$ git clone --branch v9.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v9.0.0

Machine ID service now in Preview for issuing short-lived SSH/X.509 certificates to machines/service accounts
Desktop Access GA adds clipboard sharing, session recording, and per-session MFA (requires WebAuthn)
Database Access now supports self-hosted Redis clusters with audit logging of commands
Database Access SQL Server Preview adds Microsoft SQL Server with Active Directory authentication
Database Access RDS MariaDB support expands to auto-discovery and IAM authentication (MariaDB 10.6+)

+3 more show less

teleport db configure create command generates Database Service configuration
teleport db configure bootstrap command configures IAM permissions for the Database Service on AWS
Auto-discovery expanded to support Redshift databases

8 details in Everything

└──▷ BREAKING ON UPGRADE

!Support for CentOS 6 has been removed
!Desktop Access LDAP authentication now requires X.509 client certificates; the password_file configuration option is removed

v7.3.17 Mar 3, 2022 · release notes

Teleport v7.3.17 adds cert.create audit event for certificate lifecycle tracking.

└──▷ GET THIS VERSION

$ git clone --branch v7.3.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.3.17

v8.3.0 Feb 16, 2022 · release notes

Teleport v8.3.0 adds IAM node/proxy joining in AWS, GitHub SSO team claims, and the cert.create event

└──▷ GET THIS VERSION

$ git clone --branch v8.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.3.0

Adds cert.create event to audit logs for certificate generation tracking
Enables IAM-based authentication for joining AWS EC2 nodes and proxies
Includes GitHub user group memberships in SSO claims for role mapping

3 details in Everything

v8.2.0 Feb 9, 2022 · release notes

Teleport v8.2.0 adds X11 forwarding support for Server Access sessions.

└──▷ GET THIS VERSION

$ git clone --branch v8.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.2.0

v7.3.13 Feb 4, 2022 · release notes

Teleport v7.3.13 adds canned AWS S3 ACL support and improves ACME certificate renewal for Let's Encrypt issues.

└──▷ GET THIS VERSION

$ git clone --branch v7.3.13 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.3.13

Adds support for canned AWS S3 ACLs to enable fine-grained access control on S3 buckets used by Teleport
Improves ACME support to automatically renew certificates affected by the Let's Encrypt TLS-ALPN-01 issues
Improves network utilization by replacing cluster periodics with watchers for more efficient status propagation

3 details in Everything

v7.3.12 Jan 28, 2022 · release notes

Teleport v7.3.12 adds metrics for missing SSH tunnels

└──▷ GET THIS VERSION

$ git clone --branch v7.3.12 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.3.12

v8.1.1 Jan 25, 2022 · release notes

Adds access_request.delete event tracking for Access Requests.

└──▷ GET THIS VERSION

$ git clone --branch v8.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.1.1

v8.1.0 Jan 11, 2022 · release notes

Adds RBAC for sessions, TLS verification level for database connections, and new tsh/db flags.

└──▷ GET THIS VERSION

$ git clone --branch v8.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.1.0

└──▷ USE IT

Connect to a specific cluster's database using tsh.

shell

tsh db connect --cluster=my-cluster my-db

Run the teleport proxy with diagnostics available on a custom address.

shell

teleport start --diag_addr=localhost:3001

Adds --cluster flag to tsh db connect to specify the target cluster explicitly.
Adds --diag_addr flag to the teleport binary to configure diagnostic server address.
Adds RBAC controls for shared sessions and session recordings to limit access further.
Adds TLS verification level setting for database connections to control verification strictness.

4 details in Everything

└──▷ BREAKING ON UPGRADE

!Desktop Access is no longer enabled in 32-bit ARM builds.

v7.3.10 Jan 11, 2022 · release notes

Adds -f json flag to tsh play for cluster session recording exports

└──▷ GET THIS VERSION

$ git clone --branch v7.3.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.3.10

└──▷ USE IT

Export session recording in JSON format for analysis or archival.

shell

tsh play -f json <session-id>

Updates tsh play -f json to support fetching session recordings from cluster

1 detail in Everything

v7.3.9 Dec 23, 2021 · release notes

Teleport v7.3.9 adds clearScreen session config and jittered auth reconnection.

└──▷ GET THIS VERSION

$ git clone --branch v7.3.9 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.3.9

Adds clearScreen configuration option to control whether the terminal is cleared when a session ends
Improves authentication service reconnection reliability with added jitter and backoff to prevent thundering herd

2 details in Everything

v6.2.24 Dec 23, 2021 · release notes

Adds option to clear user terminal on session end

└──▷ GET THIS VERSION

$ git clone --branch v6.2.24 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.2.24

Added support for clearing the users terminal when a session ends

1 detail in Everything

v8.0.7 Dec 21, 2021 · release notes

Teleport v8.0.7 adds configurable DynamoDB event TTL, tsh play -f json, and Helm chart enhancements.

└──▷ GET THIS VERSION

$ git clone --branch v8.0.7 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.0.7

└──▷ TRY IT

Export Teleport session playback data in JSON format for parsing by downstream tools.

$ tsh play -f json <ID>

Adds tsh play -f json subcommand for JSON output format support

1 detail in Everything

v8.0.6 Dec 15, 2021 · release notes

Adds separate listener support for Postgres and MongoDB proxies

└──▷ GET THIS VERSION

$ git clone --branch v8.0.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.0.6

proxy.listeners config section now accepts postgresql and mongodb keys with explicit network_address values to bind these services on distinct listeners instead of sharing the default port

1 detail in Everything

v8.0.1 Dec 4, 2021 · release notes

Teleport v8.0.1 adds Azure MI DB auth, RBAC session queries, tsh Windows MFA hint, and more.

└──▷ GET THIS VERSION

$ git clone --branch v8.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.0.1

└──▷ USE IT

Configure Teleport with custom TLS certificates and public address using the teleport configure subcommand.

shell

teleport configure --cert-file /path/to/cert.pem --key-file /path/to/key.pem --public-addr myserver.example.com

Adds support for --cert-file, --key-file and --public-addr to the teleport configure command
Added application metadata to application access audit events
Desktop Access: Windows Desktop discovery can now be customized by specifying a base DN and LDAP filters to search
Added Azure PostgreSQL and MySQL managed identity authentication support to database access
Added support for RBAC where condition for active sessions

5 details in Everything

v8.0.0 Nov 16, 2021 · release notes

Teleport v8.0 adds Windows Desktop Access preview, TLS multiplex routing, AWS CLI integration, dynamic registration for apps/databases, RDS discovery, WebAuthn/MFA enhancements, CockroachDB support, and tctl top metrics.

└──▷ GET THIS VERSION

$ git clone --branch v8.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v8.0.0

└──▷ USE IT

Enable TLS routing on a Teleport proxy to multiplex client connections over a single port.

yaml

auth_service:
  proxy_listener_mode: multiplex
version: v2
proxy_service:
  ...

Adds proxy_listener_mode: multiplex config key to enable TLS Routing on a single proxy port
Introduces tsh app login command for AWS console access via Application Access
Adds tsh aws commands to interact with AWS APIs through Teleport application access
Enables dynamic registration for applications and databases without static YAML or agent restarts
Adds automatic discovery of RDS instances and Aurora clusters for Teleport database agents

+7 more show less

Adds WebAuthn support for second factor authentication including Apple FaceID and TouchID
Adds second factor management tools in the Web UI for configuring MFA devices
Requires additional second factor confirmation for privileged actions like editing roles
Adds CockroachDB support to Database Access
Adds per-session MFA support to Database Access
Adds support for profile-specific kubeconfig generation
Adds metrics and network utilization display to the tctl top command

12 details in Everything

└──▷ BREAKING ON UPGRADE

!CentOS 6 support is deprecated in Teleport 8 and will be removed in Teleport 9
!Teleport 8 requires libgcc_s.so and libm.so runtime dependencies due to Rust build chain inclusion
!Database Access no longer supports certificates using CommonName for hostname verification; use Subject Alternative Name extension instead
!Default cluster role changed: new clusters no longer have an admin role, replaced by access, auditor, and editor roles

v7.3.3 Nov 2, 2021 · release notes

Adds custom routing_strategy configuration to teleport.

└──▷ GET THIS VERSION

$ git clone --branch v7.3.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.3.3

v6.2.17 Oct 28, 2021 · release notes

Teleport v6.2.17 adds support for custom routing_strategy configuration

└──▷ GET THIS VERSION

$ git clone --branch v6.2.17 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.2.17

Improved cache and label-based operations performance

1 detail in Everything

v7.3.2 Oct 20, 2021 · release notes

Adds email notification plugin for Teleport 7.3

└──▷ GET THIS VERSION

$ git clone --branch v7.3.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.3.2

v7.3.0 Oct 12, 2021 · release notes

Teleport v7.3.0 adds AWS node joining without shared secret tokens

└──▷ GET THIS VERSION

$ git clone --branch v7.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.3.0

Adds ability for nodes to join a cluster using AWS credentials instead of shared secret tokens

1 detail in Everything

v7.2.1 Oct 8, 2021 · release notes

Adds resource utilization data to tctl top and HTTP agent connection support via --insecure flag.

└──▷ GET THIS VERSION

$ git clone --branch v7.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.2.1

└──▷ TRY IT

Check current CPU and memory usage of the Teleport cluster via CLI.

$ tctl top

Allow agents to connect over unencrypted HTTP for local testing or isolated networks.

$ teleport agent --insecure

Adds network and resource utilization information to tctl top
Adds ability for agents to connect over HTTP with --insecure flag

2 details in Everything

v6.2.15 Sep 30, 2021 · release notes

Adds event/network emission metrics to tctl top for better resource monitoring

└──▷ GET THIS VERSION

$ git clone --branch v6.2.15 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.2.15

v7.2.0 Sep 29, 2021 · release notes

Teleport v7.2.0 adds HSM support and tsh ssh for Windows

└──▷ GET THIS VERSION

$ git clone --branch v7.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.2.0

Adds Hardware Security Module (HSM) support for certificate management
Adds tsh ssh support for Windows clients

2 details in Everything

v7.1.3 Sep 20, 2021 · release notes

Adds profile-specific kubeconfig support and Terraform plugin identity loading from environment variables.

└──▷ GET THIS VERSION

$ git clone --branch v7.1.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.1.3

Terraform Plugin loads identity from environment variables instead of requiring a local file.

1 detail in Everything

v7.1.1 Sep 14, 2021 · release notes

Adds --request-nowait for non-blocking access requests and profile-specific kubeconfig support in Teleport v7.1.1

└──▷ GET THIS VERSION

$ git clone --branch v7.1.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.1.1

└──▷ TRY IT

Submit an access request and immediately continue working without waiting for approval.

$ tsh login --request-nowait

--bootstrap flag no longer causes issues when starting Teleport
Adds non-blocking access request handling via the --request-nowait flag

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Connection to OpenSSH nodes with public keys or certificates not signed by Teleport via the web UI is no longer supported.

v7.1.0 Aug 18, 2021 · release notes

Teleport v7.1.0 adds user and session locking

└──▷ GET THIS VERSION

$ git clone --branch v7.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.1.0

session_locking.enabled can be set to true in teleport.yaml to enable user and session locking.
The tsh lock command is added to lock or unlock active sessions.

2 details in Everything

v7.0.0 Aug 10, 2021 · release notes

Teleport v7.0 adds MongoDB and AWS Console access, per-session BPF blocking, and tsh config improvements

└──▷ GET THIS VERSION

$ git clone --branch v7.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v7.0.0

└──▷ USE IT

Configure Teleport to point tsh to a custom directory instead of the default home.

shell

export TELEPORT_HOME=/opt/teleport-tsh

Generate an OpenSSH config snippet for easier integration with SSH clients.

shell

tsh config --format=ssh > ~/.ssh/config.d/teleport.conf

Force tsh to update the Kubernetes context after logging in.

shell

tsh login --kube-cluster my-k8s-cluster

Adds MongoDB database protocol support to Teleport Database Access
Adds GCP Cloud SQL MySQL support to Teleport Database Access
Adds AWS Management Console sign-in via identity federation to Teleport Application Access
Adds per-SSH session network traffic blocking using BPF
Updates Enhanced Session Recording to use CO-RE BPF executables (requires kernel 5.8+)

+8 more show less

Adds certificate termination on expiration for Database Access
Adds custom disconnect and MOTD message configuration for FedRAMP compliance
Adds Audit Log and session recording export via the Teleport API
Allows partial cluster configuration through cluster config resources
Adds per-host port forwarding disable capability
Adds tsh home directory configuration
Adds OpenSSH client configuration snippet generation via tsh config
Adds default-port detection to tsh

13 details in Everything

└──▷ BREAKING ON UPGRADE

!Enhanced Session Recording now requires kernel 5.8 or above
!Kubernetes Access no longer automatically registers a cluster named after the Teleport cluster; users must explicitly set kube_cluster_name to retain this functionality
!tsh login no longer changes the current Kubernetes context; use tsh login --kube-cluster or tsh kube login <kubeCluster> to update context

v6.2.8 Jul 23, 2021 · release notes

New API to export session recordings; improved Web UI performance for DynamoDB users.

└──▷ GET THIS VERSION

$ git clone --branch v6.2.8 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.2.8

Adds API endpoint to export session recordings
Improves Web UI performance when DynamoDB is used as the backend

2 details in Everything

v6.2.6 Jun 30, 2021 · release notes

Adds per-node port forwarding disable and API client endpoint updates

└──▷ GET THIS VERSION

$ git clone --branch v6.2.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.2.6

api client adds support for additional endpoints.
Added ability to disable port forwarding on a per-node basis.

2 details in Everything

v6.2.5 Jun 17, 2021 · release notes

Adds regexp.replace in role templates and new RoleV4 type with stricter defaults.

└──▷ GET THIS VERSION

$ git clone --branch v6.2.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.2.5

regexp.replace added to role templates
RoleV4 resource type added with stricter default allow labels

2 details in Everything

v4.4.10 Jun 16, 2021 · release notes

Adds log formatting options to Teleport config file

└──▷ GET THIS VERSION

$ git clone --branch v4.4.10 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.4.10

v6.2.0 May 25, 2021 · release notes

Teleport v6.2.0 adds Amazon Redshift database access support and new API/RPC capabilities for pagination and protocol handling.

└──▷ GET THIS VERSION

$ git clone --branch v6.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.2.0

└──▷ USE IT

Retain the previous behavior of forwarding a local in-memory SSH agent created from ~/.tsh.

shell

tsh ssh -o "ForwardAgent local" user@host

Adds GetSessionEventsRequest RPC endpoint for Audit Log pagination
Adds Proxy Protocol support for MySQL Database Access
Adds prepared statement support for Postgres Database Access
Added pass-through header support for Teleport Application Access
Added ability to propagate claim information from root to leaf clusters

5 details in Everything

└──▷ BREAKING ON UPGRADE

!tsh ssh -A now forwards the system SSH agent by default; use tsh ssh -o "ForwardAgent local" to retain the previous in-memory agent behavior
!DynamoDB events backend indexing strategy changed, triggering a data migration that affects event availability during upgrade

v6.1.2 Apr 22, 2021 · release notes

Teleport v6.1.2 adds log timestamp formatting.

└──▷ GET THIS VERSION

$ git clone --branch v6.1.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.1.2

Adds log formatting and support to enable timestamps for logs.

1 detail in Everything

v6.1.0 Apr 9, 2021 · release notes

Adds U2F per-session MFA for SSH/K8s sessions and dual authorization workflows for access requests in Teleport v6.1.0

└──▷ GET THIS VERSION

$ git clone --branch v6.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.1.0

Adds support for U2F authentication on every SSH and Kubernetes connection to enforce per-session MFA.
Adds the ability to request multiple users to review and approve access requests via dual authorization workflows.
Adds support for cluster routing to reduce latency to leaf clusters.
Adds support for Google Cloud SQL to Database Access.
Adds support CLI credential issuance for Application Access.

+2 more show less

Adds support for Encrypted SAML Assertions.
Adds support for user impersonation.

7 details in Everything

v6.0.2 Mar 17, 2021 · release notes

Adds role presets (auditor, editor, access) and google_service_account field for Google Workspace OIDC connector

└──▷ GET THIS VERSION

$ git clone --branch v6.0.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.0.2

Introduces built-in role presets: auditor, editor, and access to simplify RBAC setup
Adds support for the google_service_account field within the Google Workspace OIDC connector configuration

2 details in Everything

v6.0.0 Mar 3, 2021 · release notes

Teleport v6.0 adds Database Access for PostgreSQL and MySQL, open-sources RBAC, and introduces a new Go client library.

└──▷ GET THIS VERSION

$ git clone --branch v6.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v6.0.0

Database Access feature enables connecting to PostgreSQL and MySQL databases using short-lived certificates with SSO and role-based access controls
Open source support for Role-Based Access Control (RBAC) allows granular access policies for servers and resources like session recording

2 details in Everything

└──▷ BREAKING ON UPGRADE

!Upgrading SSO users with Trusted Clusters will lose connectivity to leaf clusters unless the trusted_cluster role mapping resource is updated

v5.1.0 Jan 1, 2021 · release notes

Adds Web UI support for creating and assuming Access Workflow requests via the new Activity dropdown.

└──▷ GET THIS VERSION

$ git clone --branch v5.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v5.1.0

└──▷ HOW TO FIND IT

Create or assume an access request directly from the Teleport dashboard without using the CLI.

📍In the Web UI, click Activity in the top navigation and select the new Access Requests section.

v5.0.0 Nov 24, 2020 · release notes

Teleport v5.0 adds Application Access for web apps, multi-cluster Kubernetes support, and RBAC for users/tokens

└──▷ GET THIS VERSION

$ git clone --branch v5.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v5.0.0

└──▷ TRY IT

List all registered Kubernetes clusters managed by Teleport and switch context to a specific one.

$ $ tsh kube ls
$ tsh kube login production-cluster

Output session playback events as JSON to pipe into jq for filtering specific event types.

$ $ tsh play --format=json ~/playback.tar | jq '.event'

Adds the app_service configuration section in teleport.yaml to enable proxying of internal HTTP applications via Application Access.
Introduces the --type=app flag on tctl tokens add to generate static or dynamic invite tokens for Application Access nodes.
Extends teleport start with new flags --roles=app, --app-name, and --app-uri to run an Application Access proxy node.
Adds the kubernetes_service configuration section in teleport.yaml to replace Kubernetes configuration previously located under proxy_service.
Introduces the --type=kube flag on tctl tokens add for join tokens required by the new kubernetes_service.

+6 more show less

Adds tsh kube ls and tsh kube login <cluster> subcommands to manage and switch between multiple registered Kubernetes clusters.
Adds user and token to the list of RBAC resources supported in role definitions, enabling limit and list/modify operations for users and tokens.
Supports adding --labels on tctl tokens add --type=trusted_cluster to apply cluster labels for Trusted Cluster RBAC.
Adds the https_keypairs field under proxy_service to allow loading multiple TLS certificates via SNI, replacing https_key_file and https_cert_file.
Enables local user management through the UI at https://[cluster-url]/web/users for editing, resetting, and deleting local users.
Adds the --format=json flag to tsh play to output session playback events in JSON format for programmatic processing.

11 details in Everything

└──▷ BREAKING ON UPGRADE

!The Kubernetes configuration section is moved from proxy_service to a dedicated kubernetes_service section; existing configs must migrate settings.

v4.4.4 Nov 6, 2020 · release notes

Teleport v4.4.4 adds UI-based access workflows, claims_to_roles mapping, and limited roles for forced access requests

└──▷ GET THIS VERSION

$ git clone --branch v4.4.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.4.4

└──▷ HOW TO FIND IT

Initiate an access request directly from the Teleport UI instead of using the CLI.

📍In the Teleport web console, navigate to Access Requests and create a new request.

Adds claims_to_roles config field to map external identity provider claims to requestable roles
Adds UI support for creating, approving, and assuming access requests (previously tsh only)
Supports limited roles that trigger access requests on login, denying node access until externally granted

3 details in Everything

v4.4.2 Oct 30, 2020 · release notes

Teleport v4.4.2 adds automatic arm64 builds to the download portal

└──▷ GET THIS VERSION

$ git clone --branch v4.4.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.4.2

└──▷ HOW TO FIND IT

Download the arm64 binary for your Apple Silicon Mac or ARM-based server directly from the official portal.

📍https://gravitational.com/teleport/download

v4.4.0 Oct 20, 2020 · release notes

Teleport v4.4.0 adds concurrent session control, node-sync/proxy-sync recording modes, and tctl/tsh CLI enhancements

└──▷ GET THIS VERSION

$ git clone --branch v4.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.4.0

└──▷ USE IT

Generate a kubeconfig that targets a specific leaf cluster for remote access.

shell

tctl auth sign --format kubernetes --cluster my-leaf-cluster > kubeconfig.yaml

List nodes in JSON format for programmatic consumption.

shell

tsh ls -o json

Adds max_connections and max_sessions config options to enforce AC-10 compliance by limiting user sessions.
Adds session_control_timeout config key to the auth_service block for session control timeout handling.
Introduces node-sync and proxy-sync experimental modes for session_recording, streaming directly to storage without disk buffering.
Enables specifying a leaf cluster in tctl auth sign kubeconfig generation via the --cluster flag.
Adds JSON output support to tsh ls using the -o json flag.

+1 more show less

Adds ability to trigger PAM authentication on login via the pam_authenticate configuration option.

6 details in Everything

v4.3.0 Jul 8, 2020 · release notes

Teleport v4.3 adds SSH approval plugins (PagerDuty, Jira, Slack, Mattermost) and a redesigned Web UI with audit log access.

└──▷ GET THIS VERSION

$ git clone --branch v4.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.3.0

└──▷ TRY IT

Launch the Teleport Web UI from the command line for interactive authentication.

$ tsh --browser login --user=<username>@<cluster>

Adds four new built-in SSH approval workflow plugins: PagerDuty, Jira Server, Jira Cloud, Slack, and Mattermost
Adds --browser flag to tsh CLI to launch the Web UI for authentication
Enables support for third-party S3-compatible storage for session recordings
Adds GCP backend data store support for Teleport clusters
Adds user impersonation (kube_users) support in the Kubernetes Proxy

+1 more show less

Adds X11 forwarding support for OpenSSH servers

6 details in Everything

└──▷ BREAKING ON UPGRADE

!Default SSH signing algorithm changed to SHA-512 for new clusters; existing clusters must manually set ca_signature_algo in teleport.yaml and rotate CA.
!Web UI URL structure changed due to redesign; previous URLs may be invalid.

v4.2.6 Mar 17, 2020 · release notes

Teleport v4.2.6 adds custom OIDC prompts, kubernetes_users in roles, and extended variable interpolation.

└──▷ GET THIS VERSION

$ git clone --branch v4.2.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.2.6

kubernetes_users added to role configuration to map Kubernetes users directly

1 detail in Everything

v4.2.3 Feb 21, 2020 · release notes

Teleport v4.2.3 adds PluginData support to plugins and improves PAM user creation on login

└──▷ GET THIS VERSION

$ git clone --branch v4.2.3 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.2.3

└──▷ USE IT

Use the new PluginData field in a custom Teleport plugin to pass metadata from the authentication flow.

go

import "github.com/gravitational/teleport/lib/plugins"

func (p *MyPlugin) ProcessAuth(ctx context.Context, req plugins.AuthRequest) (*plugins.AuthResponse, error) {
    // Access PluginData passed from Teleport core
    data := req.PluginData
    _ = data // Use the metadata
    return &plugins.AuthResponse{}, nil
}

Adds PluginData support to Teleport plugins via the PluginData field in plugin context objects

1 detail in Everything

v4.2.1 Jan 6, 2020 · release notes

Teleport v4.2.1 adds etcd password auth and third-party S3 support

└──▷ GET THIS VERSION

$ git clone --branch v4.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.2.1

Adds etcd password authentication support for backend storage.
Enables use of third-party S3-compatible storage providers as the backend datastore.

2 details in Everything

v4.2.0 Dec 19, 2019 · release notes

Teleport v4.2.0 adds alpha Enhanced Session Recording and Workflows API for RBAC escalation.

└──▷ GET THIS VERSION

$ git clone --branch v4.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.2.0

Adds Enhanced Session Recording in Alpha to provide deeper visibility into Teleport sessions
Adds the alpha Workflows API enabling admins to escalate RBAC roles via user requests
Enables High Availability support with Firestore and Google Cloud Storage on GCP (Beta)
Allows remote tctl execution

4 details in Everything

v4.0.11 Dec 9, 2019 · release notes

Teleport v4.0.11 adds RHEL/CentOS 6.x binary builds.

└──▷ GET THIS VERSION

$ git clone --branch v4.0.11 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.0.11

v4.1.5 Dec 9, 2019 · release notes

Teleport v4.1.5 adds RHEL/CentOS 6.x builds

└──▷ GET THIS VERSION

$ git clone --branch v4.1.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.1.5

v3.2.14 Nov 20, 2019 · release notes

Adds Docker registry and Helm repository support to tsh login

└──▷ GET THIS VERSION

$ git clone --branch v3.2.14 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v3.2.14

└──▷ TRY IT

Authenticate tsh so it can push/pull container images from a Teleport-managed registry.

$ tsh login --registry my-registry.example.com

Authenticate tsh for Helm chart repository access.

$ tsh login --helm-repo https://charts.example.com

tsh login now supports authenticating against Docker registries and Helm repositories.

1 detail in Everything

v4.1.4 Nov 6, 2019 · release notes

Teleport v4.1.4 adds GSuite service account support to its integration.

└──▷ GET THIS VERSION

$ git clone --branch v4.1.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.1.4

v4.1.2 Oct 17, 2019 · release notes

Adds FIPS-compliant Docker images for Teleport Enterprise in v4.1.2.

└──▷ GET THIS VERSION

$ git clone --branch v4.1.2 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.1.2

Added support for building Docker images using the FIPS-compliant version of Teleport
The first FIPS-compliant image is quay.io/gravitational/teleport-ent:4.1.2-fips

2 details in Everything

v4.1.0 Oct 1, 2019 · release notes

Teleport v4.1.0 adds IPv6 support, ProxyJump compatibility, tsh background mode, cluster backup/restore tool, and audit role visibility.

└──▷ GET THIS VERSION

$ git clone --branch v4.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.1.0

Adds auth_token path support in teleport.yaml configuration
Introduces a high-level tool to backup and restore the cluster state
Enables tsh to go background and without executing remote command
Implements ProxyJump compatibility for SSH proxying
Adds IPv6 support across Teleport services

+2 more show less

Kubernetes support no longer requires SNI configuration
Audit logs now include role information for visibility

7 details in Everything

v4.0.0 Jun 18, 2019 · release notes

Teleport v4.0.0 introduces IoT reverse tunnels, FIPS 140-2 builds, tctl rm, and increased connection limits

└──▷ GET THIS VERSION

$ git clone --branch v4.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v4.0.0

└──▷ USE IT

Delete a specific node from the cluster using the new tctl command

shell

tctl rm node/<node-id>

Configure public_addr for a host to prevent connection validation errors during upgrade

yaml

proxy:
  public_addr: teleport.example.com

Nodes can now dial back to a cluster via reverse tunnels to bypass firewall restrictions (IoT support)
Added FIPS 140-2 friendly build of Teleport Enterprise for FedRAMP compliance
Allows deleting nodes using tctl rm subcommand
Supports 10,000 remote connections per cluster with recommended hardware
tsh ls output is now sorted by node name

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Host certificate validation now checks if the requested host is in the public_addr list of principals; ensure hosts have correct public_addr in teleport.yaml to avoid connection failures

v3.2.4 Apr 26, 2019 · release notes

tsh now reads cluster name from TELEPORT_SITE env var and adds --bind-addr flag

└──▷ GET THIS VERSION

$ git clone --branch v3.2.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v3.2.4

└──▷ TRY IT

Set the target cluster name globally for tsh without specifying it in every command.

$ export TELEPORT_SITE=production-cluster; tsh ls

TELEPORT_SITE environment variable supported in tsh to read the cluster name

1 detail in Everything

v3.2.1 Apr 11, 2019 · release notes

Adds --bind-addr flag to tsh for forcing a specific port during SSO login.

└──▷ GET THIS VERSION

$ git clone --branch v3.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v3.2.1

└──▷ TRY IT

Force tsh to use port 8443 for the SSO callback, useful when standard ports are blocked or reserved.

$ tsh login --cloud --idp=okta --bind-addr=:8443

v3.2.0 Apr 1, 2019 · release notes

Adds Amazon EKS cluster proxy support via Kubernetes impersonation API.

└──▷ GET THIS VERSION

$ git clone --branch v3.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v3.2.0

auth_service.kubeconfig_file is moved to proxy_service.kubernetes.kubeconfig_file in /etc/teleport.yaml.

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!Teleport clusters with Kubernetes integration must move kubeconfig_file from auth_service to proxy_service/kubernetes in /etc/teleport.yaml.

v3.1.6 Feb 12, 2019 · release notes

Teleport v3.1.6 adds configurable S3/DynamoDB regions and fixes UX issues.

└──▷ GET THIS VERSION

$ git clone --branch v3.1.6 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v3.1.6

Adds tsh ls sorting by node name for better list readability
Supports configuring different AWS regions for S3 sessions and DynamoDB audit logs
Increases SSO callback timeout to 180 seconds

3 details in Everything

v3.1.4 Jan 17, 2019 · release notes

Adds GSuite SSO provider support in Teleport v3.1.4

└──▷ GET THIS VERSION

$ git clone --branch v3.1.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v3.1.4

Added gsuite as a supported SSO provider option

1 detail in Everything

v3.1.0 Dec 12, 2018 · release notes

Teleport v3.1.0 adds SOCKS5 support in tsh and regex RBAC labels

└──▷ GET THIS VERSION

$ git clone --branch v3.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v3.1.0

Adds SOCKS5 proxy support to the tsh CLI.
Adds support for regular expressions in RBAC label keys and values.
Adds i386 binaries for legacy system compatibility.

3 details in Everything

v3.0.0 Oct 2, 2018 · release notes

Teleport v3.0.0 adds Kubernetes cluster support and unified SSH/K8s RBAC

└──▷ GET THIS VERSION

$ git clone --branch v3.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v3.0.0

tsh login now retrieves and installs certificates for both Kubernetes and SSH simultaneously.
Full audit log recording of kubectl commands, including interactive kubectl exec sessions.
Unified RBAC policy engine covering both SSH and Kubernetes permissions.

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The backend now requires etcd version 3.3 or newer; older versions will fail.

v2.7.4 Aug 17, 2018 · release notes

Teleport v2.7.4 adds scalar/list node_labels in roles and fixes client_idle_timeout.

└──▷ GET THIS VERSION

$ git clone --branch v2.7.4 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.7.4

v2.7.0 Jul 27, 2018 · release notes

Teleport v2.7.0 adds Web UI scp for file transfers and forceful session termination controls.

└──▷ GET THIS VERSION

$ git clone --branch v2.7.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.7.0

Adds scp functionality to the Teleport Web UI for uploading/downloading files to SSH nodes via browser
Adds fine-grained control over forceful session termination including disconnecting idle clients after a timeout
Adds capability to forcefully disconnect clients when their certificates expire during an active SSH session

3 details in Everything

v2.6.0 May 31, 2018 · release notes

Teleport v2.6.0 adds DynamoDB and S3 storage backends, CA rotation, PAM integration, and tsh status CLI command.

└──▷ GET THIS VERSION

$ git clone --branch v2.6.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.6.0

Adds DynamoDB support for storing audit log events
Adds Amazon S3 support for storing recorded SSH sessions
Adds certificate authority (CA) rotation capability
Adds integration with Linux PAM subsystem for authentication
Adds tsh status CLI command to display authenticated clusters

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Role templates are fully removed; use role variables instead.
!Resource names can no longer contain unicode or special characters; use only characters, hyphens, and dots.
!advertise_ip is deprecated and replaced with public_addr setting.
!Default backend for new installations changed from boltdb to dir (JSON files in /var/lib/teleport/backend).
!Default set of enabled cryptographic primitives updated to reflect latest SSH/TLS security standards.

v2.5.0 Mar 13, 2018 · release notes

Teleport v2.5.0 adds NFS-backed HA auth servers, connection draining, explicit join tokens, public_addr config, gzip session recording, and -- YAML support in tctl.

└──▷ GET THIS VERSION

$ git clone --branch v2.5.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.5.0

└──▷ USE IT

Generate an explicit join token using an external mechanism instead of relying on auto-generated values.

shell

tctl node add --token=my-custom-token

Create multiple user or role resources in a single tctl create invocation using YAML list separators.

shell

echo '---
kind: user
name: alice
---
kind: user
name: bob' | tctl create -f -

Adds tctl node add --token flag to explicitly set dynamic join tokens for new nodes
Introduces public_addr configuration parameter to manage certificates for proxies behind a load balancer
Enables auth servers in HA configuration to share the same /var/lib/teleport data directory when hosted on NFS or AWS EFS
Implements built-in connection draining in the Teleport daemon for zero-downtime upgrades
Compresses session recordings by default using gzip, reducing storage requirements

+1 more show less

Allows tctl create to parse -- list item separators in YAML to create multiple resources in a single command

6 details in Everything

v2.4.1 Feb 6, 2018 · release notes

Exposes the --compat flag to Web UI users.

└──▷ GET THIS VERSION

$ git clone --branch v2.4.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.4.1

└──▷ HOW TO FIND IT

Enable compatibility mode via the web interface without using CLI flags.

📍In the Teleport Web UI, navigate to Connection Settings and select the --compat option.

--compat flag is now available in the Teleport Web UI.

1 detail in Everything

v2.4.0 Jan 10, 2018 · release notes

Teleport v2.4.0 adds recording proxy mode for OpenSSH nodes and GitHub auth for open source edition

└──▷ GET THIS VERSION

$ git clone --branch v2.4.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.4.0

Adds recording proxy mode to enable SSH session recording for nodes running OpenSSH
New commercial Teleport Editions: Pro and Business available for subscription without contracts
Enables open source edition users to authenticate against GitHub
Web UI supports persistent URLs to Teleport nodes for integration into 3rd party web apps
Allows session recording to be turned off

5 details in Everything

└──▷ BREAKING ON UPGRADE

!Teleport client tsh no longer supports being an SSH agent

v2.3.5 Oct 17, 2017 · release notes

Teleport v2.3.5 adds UI SSH port introspection.

└──▷ GET THIS VERSION

$ git clone --branch v2.3.5 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.3.5

Web UI can use introspection so users can skip explicitly specifying SSH port

1 detail in Everything

v2.3.0 Sep 20, 2017 · release notes

v2.3.0 adds Web UI OpenSSH support, on-the-fly trusted cluster management via tctl, and runtime OIDC/SAML endpoints in Enterprise.

└──▷ GET THIS VERSION

$ git clone --branch v2.3.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.3.0

└──▷ USE IT

Export a Teleport user identity into a file compatible with standard OpenSSH.

shell

tsh login --config-only

Enables managing trusted clusters dynamically via CLI instead of editing config files
Allows creating SAML/OIDC endpoints on the fly using tctl without restarting Teleport in Enterprise
Adds role template support in Enterprise Role definitions

3 details in Everything

└──▷ BREAKING ON UPGRADE

!The tsh agent command is deprecated; users must switch to native SSH Agents on their platforms.

v2.2.1 Jun 21, 2017 · release notes

Adds --compat=oldssh flag to tsh and tctl for legacy certificate format

└──▷ GET THIS VERSION

$ git clone --branch v2.2.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.2.1

└──▷ USE IT

Generate a legacy-format certificate for tsh that lacks role extensions.

shell

tsh --compat=oldssh login --user=admin

Produce legacy certificates via the tctl auth sign command.

shell

tctl auth sign --compat=oldssh --out=cert.pem

v2.2.0 Jun 13, 2017 · release notes

Teleport v2.2.0 adds HTTP CONNECT tunneling for Trusted Clusters, long-lived cert export, and SAML 2.0 integration.

└──▷ GET THIS VERSION

$ git clone --branch v2.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.2.0

Allows reading user environment files on server-side connections

1 detail in Everything

└──▷ BREAKING ON UPGRADE

!Certificate export format has been changed to match OpenSSH standards (see issue #1068)
!CA export format has been changed to match OpenSSH standards (see issue #918)

v2.0.1 Apr 11, 2017 · release notes

Teleport v2.0.1 introduces RBAC, TOTP 2FA, dynamic config APIs, and DynamoDB backend support.

└──▷ GET THIS VERSION

$ git clone --branch v2.0.1 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v2.0.1

Role-based access control (RBAC) becomes available for Teleport Enterprise, enabling granular permission management.

1 detail in Everything

v1.2.0 Oct 10, 2016 · release notes

v1.2.0 of teleport adds examples directory with sample config and systemd unit files

└──▷ GET THIS VERSION

$ git clone --branch v1.2.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v1.2.0

v1.1.0 Sep 16, 2016 · release notes

Teleport v1.1.0 adds -t flag to force TTY allocation for SSH compatibility.

└──▷ GET THIS VERSION

$ git clone --branch v1.1.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v1.1.0

└──▷ TRY IT

Force TTY allocation when using Teleport's SSH client for interactive sessions requiring pseudo-terminal support.

$ teleport ssh --user=myuser -t node.example.com

v1.0.0 Jun 17, 2016 · release notes

Teleport v1.0 release adds account lockout, trusted cluster support, and logout capability

└──▷ GET THIS VERSION

$ git clone --branch v1.0.0 https://github.com/gravitational/teleport.git
# already have the repo? check out this version:
$ git checkout v1.0.0

Adds logging out subcommand to clear temporary session keys
Supports connecting Teleport clusters via Trusted Clusters feature
Implements account lockout after N unsuccessful login attempts

3 details in Everything

└──▷ BREAKING ON UPGRADE

!YAML configuration format has changed and may require migration
!Key and session storage format has evolved; users must wipe /var/lib/teleport and ~/.tsh directories

teleport

Summary

How teleport helps

Languages

Features

What teleport offers you

release 9 total

example

release 57 total

example 11 total

release 91 total

example 9 total

release 89 total

docs

example 20 total

release 92 total

example 13 total

release 82 total

example 14 total

release 64 total

example 14 total

release 65 total

example 9 total

release 64 total

docs

example 7 total

release 36 total

example 8 total

release 31 total

example 8 total

release 31 total

example

release 25 total

example 9 total

release 22 total

example

release 23 total

example

release 21 total

example

release 16 total

docs

example

release 13 total

docs

example

release 12 total

example

release 11 total

example

release 14 total

release 12 total

example

release 11 total

example

release 9 total

example

release 10 total

example

release

example

release

example

release 7 total

example

release 8 total

release 7 total

release

example

release

example

release

example

release

release

example

release

example

release

release