Teleport is an open-source, identity-aware access plane that provides connectivity, authentication, access control, and audit for servers, Kubernetes clusters, databases, Windows desktops, web applications, and cloud APIs, and it is aimed at platform, security, and infrastructure teams that need to protect access to that infrastructure.

What it is

Teleport is a single Go binary that combines an identity-aware access proxy, a certificate authority that issues short-lived certificates, a unified access control system, and a tunneling system for reaching resources behind a firewall. It integrates with SSH nodes, Kubernetes clusters, PostgreSQL, MongoDB, CockroachDB and MySQL databases, Model Context Protocol (MCP) servers, internal web apps, Windows hosts, and networked servers. It is fully compatible with OpenSSH, sshd servers, ssh clients, and Kubernetes clusters, and it can be deployed either as a Linux daemon or as a Kubernetes deployment.

The concrete problem it solves is the sprawl of long-lived credentials and network shortcuts used to reach infrastructure. Teleport replaces shared secrets such as SSH keys and Kubernetes tokens with certificate-based authentication that expires automatically, and it replaces VPNs and bastion hosts with secure tunnels that reach resources behind NATs and firewalls. Rather than maintaining separate access paths for each protocol, it gives one identity and access layer covering both human users and workloads.

Key capabilities

• Single sign-on across cloud and on-prem infrastructure using GitHub Auth, OpenID Connect, or SAML, with endpoints such as Okta and Microsoft Entra ID.
• Certificate-based authentication with automatic expiration for all protocols, removing shared secrets such as SSH keys and Kubernetes tokens.
• Secure tunnels that reach resources behind NATs and firewalls without VPNs or bastion hosts.
• Session recording and audit across SSH, Kubernetes, database, RDP, and web sessions.
• Consistent Role-Based and Attribute-Based Access Control (RBAC/ABAC) across users, machines, workloads, and resource types.
• Just-in-Time (JIT) access requests that enforce least privilege for elevated roles and sensitive systems.
• Infrastructure introspection through the Teleport CLI or Web UI to view the status of every SSH node, database instance, Kubernetes cluster, or internal web app.

Who uses it and how

• Platform and security teams centralise SSO and access policy for mixed cloud and on-prem estates through one identity layer for humans and workloads.
• Operations teams grant short-lived, audited access to SSH nodes and Kubernetes clusters instead of distributing standing keys or tokens.
• Database and application owners expose PostgreSQL, MongoDB, CockroachDB, and MySQL instances, plus internal web apps, through the same access proxy and policy model.
• Support and incident-response staff use session sharing for collaborative troubleshooting of live sessions.
• Compliance stakeholders rely on recorded and audited SSH, Kubernetes, database, RDP, and web activity to demonstrate who accessed what.

Getting started

The README documents installing and running Teleport, with dedicated Docker and build sections, and describes deployment as either a Linux daemon or a Kubernetes deployment. Binaries, Docker images, and the source build path are the three routes the repository presents.

How it compares

The provided facts name no paid products that Teleport replaces and no comparable tools, so this page cannot draw a contrast on licence, hosting, or cost model against alternatives. Within this registry it stands alone on these facts, and readers should evaluate it directly against their own access-management stack.

When to use it — and when not

Teleport suits organisations that must consolidate access across many protocols and want certificate-based, auditable, least-privilege access instead of standing keys, VPNs, and bastion hosts. A self-hoster must operate the access plane itself, including the certificate authority and the policy configuration that governs every enrolled resource, which is real operational work rather than a drop-in agent. It is licensed under AGPL-3.0, so teams with licence constraints should confirm compatibility, and the repository carries a large open-issue count of 3262, which is worth weighing when planning support expectations.