standalone-trusted-cluster.yaml

kind: trusted_cluster
version: v2
metadata:
  # the trusted cluster name MUST match the 'cluster_name' setting of the root cluster.
  name: teleport.standalone.svc.cluster.local
spec:
  # this field allows to create tunnels that are disabled, but can be enabled later.
  # this is the only field that can be changed later.
  enabled: true
  # the token expected by the "root" cluster:
  # This can be a static token from the root cluster https://goteleport.com/docs/trustedclusters/#static-join-tokens
  # or a dynamic token generated by the root cluster https://goteleport.com/docs/trustedclusters/#dynamic-join-tokens
  token: Zs15b013ba25c99d3454336002cf9b20fb
  # the address in 'host:port' form of the reverse tunnel listening port on the
  # "root" proxy server:
  tunnel_addr: teleport.root-cluster.svc.cluster.local:3024
  # the address in 'host:port' form of the web listening port on the
  # "root" proxy server:
  web_proxy_addr: teleport.root-cluster.svc.cluster.local:443
  # RBAC for trusted clusters: it says that the users who have the role 'access'
  # on a root cluster will be mapped to the local role 'guest'
  role_map:
  - local: [access]
    remote: editor
  - local: [access]
    remote: full-admin