Expand/document remote tctl execution

[klizhentas]

Description

Sometimes it makes sense to execute tctl command non locally, e.g see comment.

Tctl by design supports remote auth server execution, however there is no UX flow for this yet.

This issue specifies additional configuration flags and UX flow for those cases.

Auth sign

Auth sign will be extended to generate identity in the format understood by tctl.
Users will have to create a special admin user with defined roles and will be able to issue client certificates for auth server authentication:

tctl auth sign --user=admin --out=identity.pem --format=tctl

The resulting identity.pem is a pair of x509 key and client certificate that could be used to communicate to the auth server.

Connecting to remote auth servers

Later on, users or robots can issue commands remotely:

tctl --auth-servers=https://auth-server-1,https://auth-server-2 --identity=identity.pem get users

--auth-servers flag is added to point to remote auth servers (right now, the list of auth servers is pulled from the config file)

--identity flag is added to point to the client certificate/key pair pem file for authentication.

pem file also contains certificate authority to trust as issued by the auth server, so client can verify the identity of the auth servers it is conecting to

[kontsevoy]

The CLI syntax is TBD

[MattiasGees]

Where can we find the spec on how the format of a tctl file has to looks like?

[kontsevoy]

@MattiasGees sorry I'm not following. what do you mean by "tctl file"?

[kontsevoy]

if you meant "config file" it's the same one teleport daemon uses, i.e. /etc/teleport.yaml which is documented.

[kontsevoy]

@klizhentas can we make the CLI identical between teleport and tctl? Teleport uses:

teleport start --auth-server=10.0.5.5

i.e. it's "server" without "s" and it doesn't require https prefix. I would propose we make both forms acceptable --auth-server and --auth-servers and let both forms take a comma-separated list, but drop "https://" schema

[kontsevoy]

BTW I believe in Teleport you can do start --auth-server=one --auth-server=two