Add a local Getting Started guide for Kubernetes

[ptgott]

Our current Getting Started guides for Teleport on Kubernetes
assume that readers are deploying resources to the cloud. Some
users may want to get started quickly without, say, asking
another team for permission to deploy a DNS zone. These users
can then read our cloud-focused guides when it comes time to
develop a proof of concept or use Teleport in production.

Hopefully, this guide will expand the range of security-minded
engineers who can get early firsthand experience with Teleport.

This guide sets up Teleport on minikube and uses the App Service
to access Kubernetes Dashboard. Because Kubernetes Dashboard is
not initially accessible outside the cluster, this guide shows
you how you can access it securely via Teleport without using
kubectl proxy.

We can also consider expanding this guide later on to introduce
the Teleport Kubernetes Service or more sophisticated RBAC rules.

Also worth noting that while this change adds a new tile to
/docs/pages/kubernetes-access/getting-started.mdx, it does not
add a new tile image. We can consider creating a new one or
using the current one.

Fixes #9359

[bearrito]

First off thanks to @ptgott for putting this improvement to documentation together. I'm just getting started with Teleport, so a guide showing me how to run locally is a big help.

There is some discrepancy between the guide and usage. Perhaps this is because I'm running minikube in a VBOX?

The one I have found so far has to do with minikube tunnel
My expectation following the guide would be that the External IP would be 127.0.0.1

If this ultimately due to running in a VBOX, I'd be happy to test or contribute anything back.

me@host:~$ kubectl config set-context --current --namespace teleport-cluster
Context "minikube" modified.

me@host:~$ minikube tunnel
Status:	
	machine: minikube
	pid: 487947
	route: 10.96.0.0/12 -> 192.168.59.100
	minikube: Running
	services: [teleport-cluster]
    errors: 
		minikube: no errors
		router: no errors
		loadbalancer emulator: no errors

The 10.x.x.x is internal. The 192.168.59.100 is my VBOX NET
There was no prompt for password

me@host:~$ ip route | grep vboxnet1
10.96.0.0/12 via 192.168.59.100 dev vboxnet1 
192.168.59.0/24 dev vboxnet1 proto kernel scope link src 192.168.59.1 

me@host:~$ kubectl config set-context --current --namespace teleport-cluster
Context "minikube" modified.

me@host:~$ kubectl get pods
NAME                               READY   STATUS    RESTARTS   AGE
teleport-cluster-94b8bdbfd-mgdrh   1/1     Running   0          37m

me@host:~$ kubectl get services 
NAME               TYPE           CLUSTER-IP       EXTERNAL-IP      PORT(S)                                                                     AGE
teleport-cluster   LoadBalancer   10.105.160.217   10.105.160.217   443:31324/TCP,3023:31939/TCP,3026:32419/TCP,3024:31173/TCP,3036:32387/TCP   37m

me@host~$ curl --insecure https://10.105.160.217:443/webapi/ping
{"auth":{"type":"local","second_factor":"otp","preferred_local_mfa":"otp","has_motd":false},"proxy":{"kube":{"enabled":true,"listen_addr":"0.0.0.0:3026"},"ssh":{"listen_addr":"[::]:3023","tunnel_listen_addr":"0.0.0.0:3024","public_addr":"teleport-cluster.teleport-cluster.svc.cluster.local:443"},"db":{"mysql_listen_addr":"0.0.0.0:3036"},"tls_routing_enabled":false},"server_version":"8.3.2","min_client_version":"7.0.0"

EDIT

Here is the routing information from the minikube VM (while the tunnel is active)

$ hostname
minikube
$ ip route
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 1024 
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15 
10.0.2.2 dev eth0 proto dhcp scope link src 10.0.2.15 metric 1024 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 
192.168.59.0/24 dev eth1 proto kernel scope link src 192.168.59.100 

With the way routing is changed when the tunnel is active, I am able to access the k8's dashboard directly from my host machine.

When I do attempt to access it through the Teleport launch, then after a timeout period I get "INTERNAL SERVER ERROR"

[probakowski]

I was able to go through the guide and everything worked correctly with Docker as minikube driver. Left one small suggestion

[probakowski]

original url (https://teleport-cluster.teleport-cluster.svc.cluster.local:443/web/invite/<token>) worked for me just fine, so maybe we can skip mentioning localhost here and just advice to visit url above?

[ptgott]

@bearrito @probakowski Thanks a lot for reviewing this! I've made some changes in response to your feedback.

[ptgott]

@r0mant @zmb3 @xinding33 would one of you have time to review this? Thanks!

[xinding33]

I left some comments with a few nits but this is an awesome guide. Great job!

[xinding33]

Since this is effectively a list anyway, what do you think of reformatting using list items?

[xinding33]

What's the "Application Service" referenced here? Can we be more specific?

Also, since the next sentence talks about "a second pod..." I think we should just say something along the lines of:

Suggested change

	In our demo, one Node is a pod that runs Teleport's Application Service to
	We will be running two pods for this demo. The first pod runs...`

[ptgott]

I wrote this back when I was mistakenly using "Node" to refer to individual resource services. I've edited the wording.

[xinding33]

Suggested change

	We recommend requiring a second factor for all Teleport users. However, for
	We recommend requiring MFA for all Teleport users in production. However, for

[xinding33]

Since we use the terminology invite token in the code block above, I suggest we stick with that here.

Suggested change

	Copy the join token so you can assign it to `JOIN_TOKEN` below, then launch the
	Copy the invite token so you can assign it to `JOIN_TOKEN` below, then launch the

[ulysseskan]

I tested the rest of the guide. It worked great.

I did have to launch the Teleport dashboard in Safari rather than Chromium 99.0.4844.88 though when using the self-signed cert. Chromium gave an error and refused to load the page, and there was no place to add an exception (though there may have been some hidden hotkey I could have pressed to allow it - I forget if this is a thing in Chrome).

I think you have an include about insecure pages already though.