● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
T

Teleport

Provisioning & Security
Open source · AGPL-3.0

Teleport is a unified access plane for infrastructure — SSH servers, Kubernetes clusters, databases, internal web apps, and Windows/RDP hosts — built around short-lived certificates instead of static credentials or standing network access.

updated 2026-07-01

What it is

Teleport is a unified access plane for infrastructure — SSH servers, Kubernetes clusters, databases, internal web apps, and Windows/RDP hosts — built around short-lived certificates instead of static credentials or standing network access. It replaces VPNs, bastion hosts, and long-lived SSH keys with identity-based access backed by mTLS certs, session recording, and audit logging. Listed here under "Provisioning" because it also handles resource enrollment and access-policy rollout across fleets, but its core value is access control, not infra creation.

Who builds it and why

Built by Teleport (formerly Gravitational), a company founded by engineers who ran infrastructure at scale and got tired of SSH key sprawl and VPN-based perimeter security. It's their commercial product with an open-core model — the OSS edition is the real engine, and the company sells the enterprise layer (SSO integrations, access requests workflows, compliance features) on top. 368 contributors and a very active commit cadence (last commit 2026-07-01) indicate this is not a side project — it's the company's entire business, so investment is durable as long as the company is.

Production readiness signal

20,558 GitHub stars, 368 contributors, and continuous releases (currently v18.9.2, a mature major version number) point to a battle-tested codebase used widely in production, not an early-stage tool. Written in Go, which fits the performance and concurrency needs of a proxy handling live SSH/K8s/DB sessions. CNCF maturity is not publicly available — Teleport is not a CNCF project, it's an independent vendor-backed OSS project, so don't expect CNCF governance or graduation signals here. License is AGPL-3.0, which matters operationally: if you modify Teleport and offer it as a network service, AGPL's copyleft terms can require you to release your changes. Legal should review this before any forked/modified deployment, especially at a SaaS company.

Who should use this

  • Teams replacing VPN-based access to servers/clusters/databases with certificate-based, auditable access.
  • Organizations that need session recording and access approval workflows for compliance (SOC2, FedRAMP, HIPAA environments).
  • Platform teams managing SSH/K8s access across many clusters and want centralized RBAC instead of per-cluster kubeconfig sprawl.
  • Anyone who wants to kill standing SSH keys and static DB credentials in favor of ephemeral, identity-bound certs.

Who should NOT use this

  • Small teams with a handful of servers and no compliance pressure — Teleport's operational overhead (running the proxy/auth service, managing certs, integrating IdP) isn't worth it versus a simple bastion + SSH CA setup.
  • Teams unwilling to run and operate another stateful service — Teleport's auth/proxy cluster becomes critical infrastructure itself and needs its own HA, backup, and upgrade discipline.
  • Companies that need the enterprise features (advanced access requests, device trust, some compliance integrations) but can't afford the commercial license — the OSS edition doesn't include everything you'll eventually want.
  • Anyone planning to fork and redistribute a modified version as a hosted service — AGPL will force disclosure obligations that may conflict with a closed-source SaaS model.

Alternatives

  • HashiCorp Boundary — similar identity-based access proxy model, tighter fit if you're already in the Vault/Consul ecosystem.
  • StrongDM — commercial-only proxy for infra access with a stronger focus on turnkey compliance reporting, less appealing if you want an OSS core.
  • Traditional bastion + SSH CA (e.g., Netflix's BLESS or a homegrown Vault SSH secrets engine) — lower operational surface if you only need SSH and already run Vault.

Pricing

Teleport is open source (AGPL-3.0) with a full-featured community edition — SSH, Kubernetes, database, and app access with certs and audit logs are free to self-host. Enterprise pricing (SSO/SAML, access request workflows, HSM support, compliance features) is not publicly available and requires contacting sales.

Frequently asked

What is Teleport?+
Teleport is a unified access plane for infrastructure — SSH servers, Kubernetes clusters, databases, internal web apps, and Windows/RDP hosts — built around short-lived certificates instead of static credentials or standing network access.
Who builds Teleport?+
Built by Teleport (formerly Gravitational), a company founded by engineers who ran infrastructure at scale and got tired of SSH key sprawl and VPN-based perimeter security.
Is Teleport production ready?+
20,558 GitHub stars, 368 contributors, and continuous releases (currently v18.9.2, a mature major version number) point to a battle-tested codebase used widely in production, not an early-stage tool. Written in Go, which fits the performance and concurrency needs of a proxy handling live SSH/K8s/DB sessions.
Who should use Teleport?+
Teams replacing VPN-based access to servers/clusters/databases with certificate-based, auditable access. Organizations that need session recording and access approval workflows for compliance (SOC2, FedRAMP, HIPAA environments).
Who should not use Teleport?+
Small teams with a handful of servers and no compliance pressure — Teleport's operational overhead (running the proxy/auth service, managing certs, integrating IdP) isn't worth it versus a simple bastion + SSH CA setup.
What are the alternatives to Teleport?+
HashiCorp Boundary — similar identity-based access proxy model, tighter fit if you're already in the Vault/Consul ecosystem. StrongDM — commercial-only proxy for infra access with a stronger focus on turnkey compliance reporting, less appealing if you want an OSS core. Traditional bastion + SSH CA (e.g.
How much does Teleport cost?+
Teleport is open source (AGPL-3.0) with a full-featured community edition — SSH, Kubernetes, database, and app access with certs and audit logs are free to self-host. Enterprise pricing (SSO/SAML, access request workflows, HSM support, compliance features) is not publicly available and requires contacting sales.