How iabhishek18/teleport works
Teleport is an identity-aware access platform: users authenticate and receive short-lived, certificate-based access, then connect through a proxy to infrastructure and have activity audited. Its documented scope includes SSH, Kubernetes, databases, desktops, web apps, cloud APIs, Git, and MCP, with shared RBAC/ABAC and just-in-time access requests. The graph combines those documented product capabilities with API and identity components visible in the tree; most server-side orchestration is not represented in the sampled files, so subsystem links are intentionally limited.
Main entry points: proxy.go Identity-Aware Proxy · client.go Teleport API Client · identityfile.go Identity and Certificates · sessions.go Interactive Sessions
Components 19
Identity and Access
- Identity and Certificates
api/identityfile/identityfile.go - MFA
api/mfa/mfa.go - RBAC and ABAC
api/gen/proto/go/teleport/decision/v1alpha1/decision_service.pb.go - Access Requests
api/accessrequest/access_request.go
Secure Connectivity
- Identity-Aware Proxy
api/client/proxy.go - Secure Tunnels
api/client/alpn.go
Infrastructure Resources
- SSH Access
api/gen/proto/go/teleport/ssh/v1/ssh.pb.go - Kubernetes Access
api/gen/proto/go/teleport/kube/v1/kube_service.pb.go - Database Access
lib/srv/db/redis/engine.go - Desktop Access
api/gen/proto/go/teleport/desktop/v1/tdpb.pb.go - Apps and APIs
api/client/webclient/webclient.go - Git and MCP
api/client/gitserver/gitserver.go
Audit and Operations
- Interactive Sessions
api/client/sessions.go - Audit Events
api/client/events.go - External Audit Storage
api/client/externalauditstorage/externalauditstorage.go - Process Identity State
lib/auth/storage/storage.go
Client Interfaces
- Web Console
web/packages/teleport/src/Console/useTabRouting.ts - Teleport API Client
api/client/client.go
Other components
- Human or Workload
Connections 18
- Human or Workload → Web Console: uses
- Human or Workload → Teleport API Client: calls
- Web Console → Teleport API Client: requests
- Teleport API Client → Identity and Certificates: obtains identity
- Teleport API Client → MFA: performs MFA
- Teleport API Client → Access Requests: requests elevation
- Identity-Aware Proxy → RBAC and ABAC: enforces policy
- Identity-Aware Proxy → Secure Tunnels: establishes
- Identity-Aware Proxy → SSH Access: connects
- Identity-Aware Proxy → Kubernetes Access: connects
- Identity-Aware Proxy → Database Access: connects
- Identity-Aware Proxy → Desktop Access: connects
- Identity-Aware Proxy → Apps and APIs: connects
- Identity-Aware Proxy → Git and MCP: connects
- Identity-Aware Proxy → Interactive Sessions: supports sessions
- Interactive Sessions → Audit Events: emits activity
- Audit Events → External Audit Storage: exports events
- Identity and Certificates → Process Identity State: persists credentials