Application Access Reference Documentation

app_service:
  # Enables application proxy service.
  enabled: yes
  # Teleport provides a small debug app called "dumper" that can be used
  # to make sure application access is working correctly. It outputs JWTs,
  #  so it can be useful when extending your application.
  debug_app: true
  # Matchers for application resources created with "tctl create" command.
  resources:
  - labels:
      "*": "*"
  # This section contains definitions of all applications proxied by this
  # service. It can contain multiple items.
  apps:
    # Name of the application. Used for identification purposes.
  - name: "grafana"
    # Free-form application description.
    description: "This is an internal Grafana instance"
    # URI and port the application is available at.
    uri: "http://localhost:3000"
    # Optional application public address to override.
    public_addr: "grafana.teleport.example.com"
    # Rewrites section.
    rewrite:
      # Rewrite the "Location" header on redirect responses replacing the
      # host with the public address of this application.
      redirect:
      - "grafana.internal.dev"
      # Headers passthrough configuration.
      headers:
      - "X-Custom-Header: example"
      - "X-External-Trait: {{external.env}}"
    # Disable application certificate validation.
    insecure_skip_verify: true
    # Optional static labels to assign to the app. Used in RBAC.
    labels:
      env: "prod"
    # Optional dynamic labels to assign to the app. Used in RBAC.
    commands:
    - name: "hostname"
      command: ["hostname"]
      period: 1m0s
    # Optional AWS-specific configurations.
    aws:
      # External ID used when assuming AWS roles for this application.
      external_id: "example-external-id"
  - name: "azure-cli"
    # Optional: For access to cloud provider APIs, specify the cloud provider.
    # Allowed values are "AWS", "Azure", and "GCP".
    cloud: "Azure"

kind: app
version: v3
metadata:
  # Application name.
  name: example
  # Application description.
  description: "Example application"
  # Application static labels.
  labels:
    env: local
spec:
  # URI and port application is available at.
  uri: http://localhost:4321
  # Optional application public address.
  public_addr: test.example.com
  # Disable application certificate validation.
  insecure_skip_verify: true
  # Rewrites configuration.
  rewrite:
    # Rewrite the "Location" header on redirect responses replacing the
    # host with the public address of this application.
    redirect:
    - "grafana.internal.dev"
    # Headers passthrough configuration.
    headers:
    - name: "X-Custom-Header"
      value: "example"
    - name: "X-External-Trait"
      value: "{{external.env}}"
  # Optional dynamic labels.
  dynamic_labels:
  - name: "hostname"
    command: ["hostname"]
    period: 1m0s