# iabhishek18/teleport architecture

> Architecture diagram of the GitHub repository iabhishek18/teleport, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/iabhishek18/teleport
- Repository: https://github.com/iabhishek18/teleport

## Overview

Teleport is an identity-aware access platform: users authenticate and receive short-lived, certificate-based access, then connect through a proxy to infrastructure and have activity audited. Its documented scope includes SSH, Kubernetes, databases, desktops, web apps, cloud APIs, Git, and MCP, with shared RBAC/ABAC and just-in-time access requests. The graph combines those documented product capabilities with API and identity components visible in the tree; most server-side orchestration is not represented in the sampled files, so subsystem links are intentionally limited.

Main entry points: [`api/client/proxy.go`](https://github.com/iabhishek18/teleport/blob/master/api/client/proxy.go) (Identity-Aware Proxy), [`api/client/client.go`](https://github.com/iabhishek18/teleport/blob/master/api/client/client.go) (Teleport API Client), [`api/identityfile/identityfile.go`](https://github.com/iabhishek18/teleport/blob/master/api/identityfile/identityfile.go) (Identity and Certificates), [`api/client/sessions.go`](https://github.com/iabhishek18/teleport/blob/master/api/client/sessions.go) (Interactive Sessions)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_access["Identity and Access"]
  node_identity["Identity and Certificates<br/>[identityfile.go]"]
  node_mfa["MFA<br/>[mfa.go]"]
  node_access_control["RBAC and ABAC"]
  node_jit["Access Requests<br/>[access_request.go]"]
end

subgraph group_connect["Secure Connectivity"]
  node_proxy["Identity-Aware Proxy<br/>[proxy.go]"]
  node_tunnels["Secure Tunnels<br/>[alpn.go]"]
end

subgraph group_resources["Infrastructure Resources"]
  node_ssh["SSH Access<br/>[ssh.pb.go]"]
  node_kubernetes["Kubernetes Access<br/>[kube_service.pb.go]"]
  node_databases["Database Access<br/>[engine.go]"]
  node_desktops["Desktop Access<br/>[tdpb.pb.go]"]
  node_applications["Apps and APIs<br/>[webclient.go]"]
  node_git_mcp["Git and MCP<br/>[gitserver.go]"]
end

subgraph group_audit["Audit and Operations"]
  node_session["Interactive Sessions<br/>[sessions.go]"]
  node_audit_events["Audit Events<br/>[events.go]"]
  node_audit_storage["External Audit Storage"]
  node_process_state[("Process Identity State<br/>[storage.go]")]
end

subgraph group_interfaces["Client Interfaces"]
  node_console["Web Console<br/>[useTabRouting.ts]"]
  node_api["Teleport API Client<br/>[client.go]"]
end

node_user(("Human or Workload"))

node_user -->|"uses"| node_console
node_user -->|"calls"| node_api
node_console -->|"requests"| node_api
node_api -->|"obtains identity"| node_identity
node_api -->|"performs MFA"| node_mfa
node_api -->|"requests elevation"| node_jit
node_proxy -->|"enforces policy"| node_access_control
node_proxy -->|"establishes"| node_tunnels
node_proxy -->|"connects"| node_ssh
node_proxy -->|"connects"| node_kubernetes
node_proxy -->|"connects"| node_databases
node_proxy -->|"connects"| node_desktops
node_proxy -->|"connects"| node_applications
node_proxy -->|"connects"| node_git_mcp
node_proxy -->|"supports sessions"| node_session
node_session -->|"emits activity"| node_audit_events
node_audit_events -.->|"exports events"| node_audit_storage
node_identity -->|"persists credentials"| node_process_state

click node_console "https://github.com/iabhishek18/teleport/blob/master/web/packages/teleport/src/Console/useTabRouting.ts"
click node_api "https://github.com/iabhishek18/teleport/blob/master/api/client/client.go"
click node_identity "https://github.com/iabhishek18/teleport/blob/master/api/identityfile/identityfile.go"
click node_mfa "https://github.com/iabhishek18/teleport/blob/master/api/mfa/mfa.go"
click node_access_control "https://github.com/iabhishek18/teleport/blob/master/api/gen/proto/go/teleport/decision/v1alpha1/decision_service.pb.go"
click node_jit "https://github.com/iabhishek18/teleport/blob/master/api/accessrequest/access_request.go"
click node_proxy "https://github.com/iabhishek18/teleport/blob/master/api/client/proxy.go"
click node_tunnels "https://github.com/iabhishek18/teleport/blob/master/api/client/alpn.go"
click node_ssh "https://github.com/iabhishek18/teleport/blob/master/api/gen/proto/go/teleport/ssh/v1/ssh.pb.go"
click node_kubernetes "https://github.com/iabhishek18/teleport/blob/master/api/gen/proto/go/teleport/kube/v1/kube_service.pb.go"
click node_databases "https://github.com/iabhishek18/teleport/blob/master/lib/srv/db/redis/engine.go"
click node_desktops "https://github.com/iabhishek18/teleport/blob/master/api/gen/proto/go/teleport/desktop/v1/tdpb.pb.go"
click node_applications "https://github.com/iabhishek18/teleport/blob/master/api/client/webclient/webclient.go"
click node_git_mcp "https://github.com/iabhishek18/teleport/blob/master/api/client/gitserver/gitserver.go"
click node_session "https://github.com/iabhishek18/teleport/blob/master/api/client/sessions.go"
click node_audit_events "https://github.com/iabhishek18/teleport/blob/master/api/client/events.go"
click node_audit_storage "https://github.com/iabhishek18/teleport/blob/master/api/client/externalauditstorage/externalauditstorage.go"
click node_process_state "https://github.com/iabhishek18/teleport/blob/master/lib/auth/storage/storage.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_identity,node_mfa,node_access_control,node_jit toneBlue
class node_proxy,node_tunnels toneAmber
class node_ssh,node_kubernetes,node_databases,node_desktops,node_applications,node_git_mcp toneMint
class node_session,node_audit_events,node_audit_storage,node_process_state toneRose
class node_console,node_api,node_user toneIndigo
```

## Components

### Identity and Access

- [Identity and Certificates](https://github.com/iabhishek18/teleport/blob/master/api/identityfile/identityfile.go): `api/identityfile/identityfile.go`
- [MFA](https://github.com/iabhishek18/teleport/blob/master/api/mfa/mfa.go): `api/mfa/mfa.go`
- [RBAC and ABAC](https://github.com/iabhishek18/teleport/blob/master/api/gen/proto/go/teleport/decision/v1alpha1/decision_service.pb.go): `api/gen/proto/go/teleport/decision/v1alpha1/decision_service.pb.go`
- [Access Requests](https://github.com/iabhishek18/teleport/blob/master/api/accessrequest/access_request.go): `api/accessrequest/access_request.go`

### Secure Connectivity

- [Identity-Aware Proxy](https://github.com/iabhishek18/teleport/blob/master/api/client/proxy.go): `api/client/proxy.go`
- [Secure Tunnels](https://github.com/iabhishek18/teleport/blob/master/api/client/alpn.go): `api/client/alpn.go`

### Infrastructure Resources

- [SSH Access](https://github.com/iabhishek18/teleport/blob/master/api/gen/proto/go/teleport/ssh/v1/ssh.pb.go): `api/gen/proto/go/teleport/ssh/v1/ssh.pb.go`
- [Kubernetes Access](https://github.com/iabhishek18/teleport/blob/master/api/gen/proto/go/teleport/kube/v1/kube_service.pb.go): `api/gen/proto/go/teleport/kube/v1/kube_service.pb.go`
- [Database Access](https://github.com/iabhishek18/teleport/blob/master/lib/srv/db/redis/engine.go): `lib/srv/db/redis/engine.go`
- [Desktop Access](https://github.com/iabhishek18/teleport/blob/master/api/gen/proto/go/teleport/desktop/v1/tdpb.pb.go): `api/gen/proto/go/teleport/desktop/v1/tdpb.pb.go`
- [Apps and APIs](https://github.com/iabhishek18/teleport/blob/master/api/client/webclient/webclient.go): `api/client/webclient/webclient.go`
- [Git and MCP](https://github.com/iabhishek18/teleport/blob/master/api/client/gitserver/gitserver.go): `api/client/gitserver/gitserver.go`

### Audit and Operations

- [Interactive Sessions](https://github.com/iabhishek18/teleport/blob/master/api/client/sessions.go): `api/client/sessions.go`
- [Audit Events](https://github.com/iabhishek18/teleport/blob/master/api/client/events.go): `api/client/events.go`
- [External Audit Storage](https://github.com/iabhishek18/teleport/blob/master/api/client/externalauditstorage/externalauditstorage.go): `api/client/externalauditstorage/externalauditstorage.go`
- [Process Identity State](https://github.com/iabhishek18/teleport/blob/master/lib/auth/storage/storage.go): `lib/auth/storage/storage.go`

### Client Interfaces

- [Web Console](https://github.com/iabhishek18/teleport/blob/master/web/packages/teleport/src/Console/useTabRouting.ts): `web/packages/teleport/src/Console/useTabRouting.ts`
- [Teleport API Client](https://github.com/iabhishek18/teleport/blob/master/api/client/client.go): `api/client/client.go`

### Other components

- **Human or Workload**

## Connections

- Human or Workload → Web Console: uses
- Human or Workload → Teleport API Client: calls
- Web Console → Teleport API Client: requests
- Teleport API Client → Identity and Certificates: obtains identity
- Teleport API Client → MFA: performs MFA
- Teleport API Client → Access Requests: requests elevation
- Identity-Aware Proxy → RBAC and ABAC: enforces policy
- Identity-Aware Proxy → Secure Tunnels: establishes
- Identity-Aware Proxy → SSH Access: connects
- Identity-Aware Proxy → Kubernetes Access: connects
- Identity-Aware Proxy → Database Access: connects
- Identity-Aware Proxy → Desktop Access: connects
- Identity-Aware Proxy → Apps and APIs: connects
- Identity-Aware Proxy → Git and MCP: connects
- Identity-Aware Proxy → Interactive Sessions: supports sessions
- Interactive Sessions → Audit Events: emits activity
- Audit Events → External Audit Storage: exports events
- Identity and Certificates → Process Identity State: persists credentials