Get the Exact Identity Solution you Need in the Cloud - Deep Dive
1 like253 views
This document outlines a webcast on containerized Identity and Access Management (IAM) solutions using Amazon Web Services, focusing on Kubernetes architecture and ForgeRock product deployment. It discusses configuration management strategies, deployment flows, and future plans for simplifying access manager deployment. The document emphasizes the importance of customization, continuous integration, and monitoring strategies in a cloud environment.
Get the Exact Identity Solution you Need in the Cloud - Deep Dive
- 1. HUBCITYMEDIA! Get the Exact IAM Solution You Need ! In the Cloud Deep Dive - Containerized IAM on Amazon Web Services (Webcast 2 of 3) ! HUBCITYMEDIA!
- 2. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. 2! Introductions
- 3. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. 3! Webcast 1 Recap Why Containerized IAM Customize the solution to meet ALL of your needs! ! ! Why Kubernetes Architecture, Deployment Landscape, ForgeRock DevOps! ! ! Containerized IAM on AWS Infrastructure, Product Configuration, Client Use Case ! ! ! Check out the recording of Webcast 1 - Link in Attachments! ! !
- 4. HUBCITYMEDIA! ForgeOps Recap: What is it?! Platform Configuration Strategy and Helm ! Demo: Deploying ForgeRock AM! Architecture Review: Cloud Deployments! Continuous Integration Strategies! ! Q&A! Monitoring Strategies! Kops and ForgeOps Customizations!
- 5. HUBCITYMEDIA! ForgeOps Recap The ForgeOps Repository provides demonstration Dockerfiles and Kubernetes / Helm artifacts ● You will need to modify these files for your environment Open Source - https://github.com/ForgeRock Yes - ForgeRock supports our products running in Docker / Kubernetes! (*) - ForgeRock provides commercial support for the platform (AM, DS, IDM, IG). We expect our partners / clients to have Kubernetes experience! 5 Copyright © 2018 ForgeRock. All rights reserved
- 6. HUBCITYMEDIA! DevOps Guide https://backstage.forgerock.com/docs/platform/6/ devops-guide/ Read the Fine Manual! Now with task flowcharts! 6 Copyright © 2018 ForgeRock. All rights reserved
- 7. HUBCITYMEDIA! ForgeOps Configuration Configuration is in json (a human-ish readable format)! Configuration needs to be provided to Amster / AM somehow...! ● We think production users will want to manage configuration in a git repo! ○ Allows for versioning, audit, rollback, etc.! ○ Potential for “gitOps” - deploy a new configuration when a git PR is merged! ● But other strategies are possible...! ○ Bake configuration files into the Docker container ! ○ Put them on an S3 bucket, NFS volume, etc.! ! 7 Copyright © 2018 ForgeRock. All rights reserved
- 8. HUBCITYMEDIA! Configuration Options 8 Copyright © 2018 ForgeRock. All rights reserved
- 9. HUBCITYMEDIA! 9 Copyright © 2018 ForgeRock. All rights reserved Helm Helm - A “package” manager for Kubernetes ! • Packages up Kubernetes manifests for an application! • Example: helm install wordpress Some helm commands: helm list - show the “releases” deployed to your cluster helm install - install a package. Creates a “release” helm delete - deletes a release
- 10. HUBCITYMEDIA! ForgeRock Access Manager Deployment Flow 1. Deploy frconfig chart (one time activity)! a. Holds the URLs and credentials needed to pull from a git repository! b. We might extend this chart in the future with other pre-requisites! 2. Deploy directories for configuration, CTS and user store! 3. Deploy Access Manager! a. It has a dependency on the config store ! b. Waits for config store to be available, then checks to see if there is a valid configuration! i. Create a bootstrap if there is an existing configuration. Otherwise - boot into configurator.! 4. Deploy Amster container! a. Amster spins waiting for AM to come up. If it is already configured, it does not reapply configuration.! b. Optional: Take exports from AM, commit them to git! For development: Iterate steps 2 > 4! Copyright © 2018 ForgeRock. All rights reserved
- 12. HUBCITYMEDIA! Sneak Peak: Our plans to simplify deployment Boot Access Manager directly from json configuration files! ● Eliminates the requirement for an amster bootstrap pod! ● Simplifies sequencing of bootstrap: No need to wait for a configuration store to be provisioned! ● No more “Install” Phase - there is just a “run” phase! Easier Secrets Management with Commons Secrets integration! ● Manage key material, admin credentials using commons secrets! ● Allow for “attaching” secrets per environment, instead of migrating them! ● Pluggable backend architecture! ○ Future support for Hashicorp Vault, or other secret backends! !
- 13. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Architecture Review 13! Automated Cluster Build! • AWS VPC! • Supporting AWS Infrastructure! • Kubernetes! • CI System! • Monitoring Infrastructure!
- 14. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Architecture Review 14! Continuous Integration! • IG/AM! • IDM! • DS via Config. Mgmt.!
- 15. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Core Infrastructure Build Processes 15! Stage 1 VPC! ! Parameterized CF Stack! ! Maps to Regional AMIs and Machine Types! ! Monitoring Stack! ! ! Stage 2 Kubernetes! ! Multi-AZ! ! Full Cluster Deployment! ! Customized AMIs! ! Stage 3 Applications! ! First CI run deploys apps! supporting AWS Svcs! ! !
- 16. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. 16! Node AMIs ! Customized for additional monitoring telemetry- Disk, CPU, etc.! ! NGINX Gateways! ! ! Docker Files ! Customized for additional monitoring telemetry – primarily JVM Stats! Sizing for production! ! K8s Deployments! ! Fully customized! ! No Helm! ! No Auto-scaling! ! ! MCS Ops Guide Tailored per client environment! ! ! HCM Kops and ForgeOps Customizations
- 17. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Continuous Integration Strategies 17! IG ! Fully Immutable! ! All config in Docker Image! ! Deployment and Roll back ! ! Elastically Scalable! ! ! AM ! Partially Immutable! ! Config in DS and Files! ! Elastically Scalable - Stateless! ! ! IDM ! Partially Immutable! ! Config DB/Files! ! Elastically Scalable! ! ! DS ! Not Containerized! ! Config. Mgmt. Approach! ! Ansible Automated build and updates! ! !
- 18. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Monitoring Strategies 18!
- 19. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Challenges 19! Networking and Kops Running Kops without Internet Gateway ! (one year ago)! ! ! Kubernetes plumbing can leak…or burst ! Proxies! ! Networking! ! Load balancers! ! ! Non TCP/ IP Services (RADIUS) NGINX! ! ! Managing configuration without consoles ! Big shift in thinking for application user! ! What is immutable vs. application data?! ! !
- 20. HUBCITYMEDIA! What you need before taking this on in AWS! FINAL WORDS!
- 22. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Webcast Series POSSIBILITIES! ARCHITECTURE! DEVOPS! Thank you for joining us!! September 12, 2018! 2:00pm-3:00pm EST! 22!