Downloaded 12 times
Uploaded byForgeRock
Get the Exact Identity Solution you Need in the Cloud - Deep Dive
This document outlines a webcast on containerized Identity and Access Management (IAM) solutions using Amazon Web Services, focusing on Kubernetes architecture and ForgeRock product deployment. It discusses configuration management strategies, deployment flows, and future plans for simplifying access manager deployment. The document emphasizes the importance of customization, continuous integration, and monitoring strategies in a cloud environment.
More Related Content
![[Konveyor] adding security to dev ops for your kubernetes native applications](https://cdn.slidesharecdn.com/ss_thumbnails/konveyoraddingsecuritytodevopsforyourkubernetesnativeapplications-210514123859-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to Get the Exact Identity Solution you Need in the Cloud - Deep Dive
![[AWS Container Service] Getting Started with Kubernetes on AWS](https://cdn.slidesharecdn.com/ss_thumbnails/200gettingstartedwithkubernetesonaws-190326085832-thumbnail.jpg?width=640&height=640&fit=bounds)
![[DevFest Strasbourg 2025] - NodeJs Can do that !!](https://cdn.slidesharecdn.com/ss_thumbnails/devfeststrasbourg2025-nodejscandothat-251127142731-da65b6fd-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Mobile Engineer and Software Engineer: Are we...](https://cdn.slidesharecdn.com/ss_thumbnails/md-mobileengineerandsoftwareengineerarewestillrelevantsidiqpermana-251127010650-55224ef1-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Crafting Immersive UI with E2E and AGSL Shade...](https://cdn.slidesharecdn.com/ss_thumbnails/md-craftingimmersiveuiwithe2eandagslshaderveronicaputrianggraini-251124030840-0c677f44-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...](https://cdn.slidesharecdn.com/ss_thumbnails/ai-aifortheunderdogsinnovationforsmallbusinesses-251124030839-72a599a4-thumbnail.jpg?width=640&height=640&fit=bounds)
Get the Exact Identity Solution you Need in the Cloud - Deep Dive
- 1. HUBCITYMEDIA! Get the ExactIAM Solution You Need ! In the Cloud Deep Dive - Containerized IAM on Amazon Web Services (Webcast 2 of 3) ! HUBCITYMEDIA!
- 2. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. 2! Introductions
- 3. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. 3! Webcast 1 Recap Why Containerized IAM Customize the solution to meet ALL of your needs! ! ! Why Kubernetes Architecture, Deployment Landscape, ForgeRock DevOps! ! ! Containerized IAM on AWS Infrastructure, Product Configuration, Client Use Case ! ! ! Check out the recording of Webcast 1 - Link in Attachments! ! !
- 4. HUBCITYMEDIA! ForgeOps Recap: What is it?! Platform Configuration Strategyand Helm ! Demo: Deploying ForgeRock AM! Architecture Review: Cloud Deployments! Continuous Integration Strategies! ! Q&A! Monitoring Strategies! Kops and ForgeOps Customizations!
- 5. HUBCITYMEDIA! ForgeOps Recap The ForgeOpsRepository provides demonstration Dockerfiles and Kubernetes / Helm artifacts ● You will need to modify these files for your environment Open Source - https://github.com/ForgeRock Yes - ForgeRock supports our products running in Docker / Kubernetes! (*) - ForgeRock provides commercial support for the platform (AM, DS, IDM, IG). We expect our partners / clients to have Kubernetes experience! 5 Copyright © 2018 ForgeRock. All rights reserved
- 6. HUBCITYMEDIA! DevOps Guide https://backstage.forgerock.com/docs/platform/6/ devops-guide/ Readthe Fine Manual! Now with task flowcharts! 6 Copyright © 2018 ForgeRock. All rights reserved
- 7. HUBCITYMEDIA! ForgeOps Configuration Configuration isin json (a human-ish readable format)! Configuration needs to be provided to Amster / AM somehow...! ● We think production users will want to manage configuration in a git repo! ○ Allows for versioning, audit, rollback, etc.! ○ Potential for “gitOps” - deploy a new configuration when a git PR is merged! ● But other strategies are possible...! ○ Bake configuration files into the Docker container ! ○ Put them on an S3 bucket, NFS volume, etc.! ! 7 Copyright © 2018 ForgeRock. All rights reserved
- 8. HUBCITYMEDIA! Configuration Options 8 Copyright ©2018 ForgeRock. All rights reserved
- 9. HUBCITYMEDIA! 9 Copyright ©2018 ForgeRock. All rights reserved Helm Helm - A “package” manager for Kubernetes ! • Packages up Kubernetes manifests for an application! • Example: helm install wordpress Some helm commands: helm list - show the “releases” deployed to your cluster helm install - install a package. Creates a “release” helm delete - deletes a release
- 10. HUBCITYMEDIA! ForgeRock Access ManagerDeployment Flow 1. Deploy frconfig chart (one time activity)! a. Holds the URLs and credentials needed to pull from a git repository! b. We might extend this chart in the future with other pre-requisites! 2. Deploy directories for configuration, CTS and user store! 3. Deploy Access Manager! a. It has a dependency on the config store ! b. Waits for config store to be available, then checks to see if there is a valid configuration! i. Create a bootstrap if there is an existing configuration. Otherwise - boot into configurator.! 4. Deploy Amster container! a. Amster spins waiting for AM to come up. If it is already configured, it does not reapply configuration.! b. Optional: Take exports from AM, commit them to git! For development: Iterate steps 2 > 4! Copyright © 2018 ForgeRock. All rights reserved
- 11.
- 12. HUBCITYMEDIA! Sneak Peak: Ourplans to simplify deployment Boot Access Manager directly from json configuration files! ● Eliminates the requirement for an amster bootstrap pod! ● Simplifies sequencing of bootstrap: No need to wait for a configuration store to be provisioned! ● No more “Install” Phase - there is just a “run” phase! Easier Secrets Management with Commons Secrets integration! ● Manage key material, admin credentials using commons secrets! ● Allow for “attaching” secrets per environment, instead of migrating them! ● Pluggable backend architecture! ○ Future support for Hashicorp Vault, or other secret backends! !
- 13. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. Architecture Review 13! Automated Cluster Build! • AWS VPC! • Supporting AWS Infrastructure! • Kubernetes! • CI System! • Monitoring Infrastructure!
- 14. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. Architecture Review 14! Continuous Integration! • IG/AM! • IDM! • DS via Config. Mgmt.!
- 15. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. Core Infrastructure Build Processes 15! Stage 1 VPC! ! Parameterized CF Stack! ! Maps to Regional AMIs and Machine Types! ! Monitoring Stack! ! ! Stage 2 Kubernetes! ! Multi-AZ! ! Full Cluster Deployment! ! Customized AMIs! ! Stage 3 Applications! ! First CI run deploys apps! supporting AWS Svcs! ! !
- 16. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. 16! Node AMIs ! Customized for additional monitoring telemetry- Disk, CPU, etc.! ! NGINX Gateways! ! ! Docker Files ! Customized for additional monitoring telemetry – primarily JVM Stats! Sizing for production! ! K8s Deployments! ! Fully customized! ! No Helm! ! No Auto-scaling! ! ! MCS Ops Guide Tailored per client environment! ! ! HCM Kops and ForgeOps Customizations
- 17. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. Continuous Integration Strategies 17! IG ! Fully Immutable! ! All config in Docker Image! ! Deployment and Roll back ! ! Elastically Scalable! ! ! AM ! Partially Immutable! ! Config in DS and Files! ! Elastically Scalable - Stateless! ! ! IDM ! Partially Immutable! ! Config DB/Files! ! Elastically Scalable! ! ! DS ! Not Containerized! ! Config. Mgmt. Approach! ! Ansible Automated build and updates! ! !
- 18. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. Monitoring Strategies 18!
- 19. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. Challenges 19! Networking and Kops Running Kops without Internet Gateway ! (one year ago)! ! ! Kubernetes plumbing can leak…or burst ! Proxies! ! Networking! ! Load balancers! ! ! Non TCP/ IP Services (RADIUS) NGINX! ! ! Managing configuration without consoles ! Big shift in thinking for application user! ! What is immutable vs. application data?! ! !
- 20. HUBCITYMEDIA! What you need beforetaking this on in AWS! FINAL WORDS!
- 21.
- 22. HUBCITYMEDIA!Copyright © 2018HUBCITYMEDIA. All rights reserved. Webcast Series POSSIBILITIES! ARCHITECTURE! DEVOPS! Thank you for joining us!! September 12, 2018! 2:00pm-3:00pm EST! 22!
- 23.