Syncs users from a JumpCloud group into Teleport Community Edition as local users. Designed to run as a Kubernetes Deployment with a tbot sidecar in the same cluster/namespace as Teleport.

┌────────────┐    API     ┌───────────────┐  tbot daemon  ┌─────────────┐
│ JumpCloud  │◄───────────│  Deployment   │──────────────►│  Teleport   │
│  (group)   │            │               │   identity    │  Auth Svc   │
└────────────┘            │ sidecar: tbot │──────────────►│             │
                          │ main: sync    │   Go client   └─────────────┘
                          └───────────────┘

The tbot sidecar runs continuously, renewing certificates automatically. The sync container waits for the identity file, runs an initial sync at startup, then follows the configured cron schedule internally.

• Teleport Community Edition running in Kubernetes
• JumpCloud service account (client ID + secret) with read access to users and groups: https://console.jumpcloud.com/#/settings/service-accounts

The chart automatically creates the Teleport bot, role, and join token via a post-install hook. No manual tctl step needed.

helm repo add jumpcloud-teleport-sync https://moveaxlab.github.io/jumpcloud-teleport-sync/

helm install jumpcloud-teleport-sync jumpcloud-teleport-sync/jumpcloud-teleport-sync -n teleport \
  --set jumpcloud.groupName="My Teleport Users" \
  --set jumpcloud.clientID="your-client-id" \
  --set jumpcloud.clientSecret="your-client-secret" \
  --set jumpcloud.orgID="your-org-id"

helm install jumpcloud-teleport-sync jumpcloud-teleport-sync/jumpcloud-teleport-sync -n teleport \
  --set jumpcloud.groupName="My Teleport Users" \
  --set jumpcloud.clientID="your-client-id" \
  --set jumpcloud.clientSecret="your-client-secret" \
  --set jumpcloud.orgID="your-org-id" \
  --set dryRun=true

kubectl logs -f deployment/jumpcloud-teleport-sync -c sync -n teleport

The chart includes a post-install/post-upgrade hook that:

1. Finds the running Teleport auth pod via label selector
2. Runs tctl create -f to upsert the bot role and join token (idempotent)
3. Checks if the bot exists before creating it (idempotent)

This means ArgoCD can re-sync freely without errors. The hook resources use before-hook-creation delete policy, so stale Jobs are cleaned up.

To disable the hook and manage setup manually:

helm install jumpcloud-teleport-sync jumpcloud-teleport-sync/jumpcloud-teleport-sync -n teleport \
  --set setup.enabled=false \
  ...

Then run ./setup-teleport-bot.sh manually with tctl access.

• Creates Teleport users for new JumpCloud group members (with invite link)
• Updates email, name, and roles if changed
• Locks + deletes users removed from the JumpCloud group
• Skips users not managed by this tool (no managed-by: jumpcloud-scim-sync label)
• Suspended/deactivated JumpCloud users are skipped
• The sync container waits for tbot to generate the identity file before starting
• On SIGTERM/SIGINT the process shuts down gracefully, waiting for any in-flight sync to complete