Teleport: Feature Request: `tsh login` should support `--bind` parameter

[osterman]

What happened:

Running tsh login inside of a docker container on "Docker for Mac" opens a server on a random port that we cannot access. We cannot use --net=host on "Docker for Mac", so we need a way to explicitly port map a port to the container.

What you expected to happen:

We expected tsh login support an argument to specify an explicit port.

For example, we use kubectl proxy inside of the same container. With kubectl proxy, we do the following:

kubectl proxy --port=12345 --address=0.0.0.0 --accept-hosts='.*'

With tsh login, we would expect to be able to do something similar:

tsh login --bind=0.0.0.0:12345

Which would permit us to do something like this when we start up our container:

docker run -it -p 12345:12345 ourcontainer sh

[kontsevoy]

Love it. Two considerations:

• --bind-addr is more explicit and consistent with Teleport's flag/parameter naming.
• --bind-addr is obviously more convenient than separate --bind-port and --bind-address but it makes it a bit harder (but not impossible) to support IPv6, i.e.

$ tsh login --bind-addr=[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:12345

.. should work.

[osterman]

@kontsevoy thanks for your vote! Your considerations make sense to me.

[osterman]

One more feature request related to this: support TSH_LOGIN_BIND_ADDR environment variable so we can set this at the container level.

e.g.

export TSH_LOGIN_BIND_ADDR="[2001:0db8:85a3:0000:0000:8a2e:0370:7334]:12345"

[osterman]

@klizhentas any updates on this? We are blocked on this for one of our Teleport Enterprise customers and will soon have this with another Enterprise customer =)

[klizhentas]

@osterman understood. We will roll this for 3.2.x patch early next week.

[klizhentas]

working on this right now

[osterman]

Thanks for the update @klizhentas

[klizhentas]

Working versions:

# host:port
tsh login  --bind-addr=localhost:3333
# just port (all interfaces)
tsh login --bind-addr=:3333
# ipv6 format
tsh login --bind-addr=[::1]:3333
# pass through environment variable
TELEPORT_LOGIN_BIND_ADDR=localhost:7777 tsh login

[osterman]

Beautiful!! @nuru can you give this a go?

[Nuru]

Not a complete solution, @osterman. See https://github.com/gravitational/teleport/pull/2646#issuecomment-482704679

[osterman]

@klizhentas we got everything working in geodesic. We can now tsh login inside our containers. Thanks so much for helping us get this working.