Get the Exact Identity Solution you Need in the Cloud - Deep Dive
•
1 like•238 views
Containerized IAM on Amazon Web Services - Deep Dive A deep technical look at the architecture behind running containerized IAM on AWS and what your team needs for a successful deployment You’ll experience an in depth review of: Assets and processes needed to containerize ForgeRock Architecture and processes guiding containerized IAM on AWS How containers are deployed into Kubernetes Monitoring and management strategies Continuous integration configuration
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Get the Exact Identity Solution you Need in the Cloud - Deep Dive
Similar to Get the Exact Identity Solution you Need in the Cloud - Deep Dive (20)
More from ForgeRock
More from ForgeRock (20)
Recently uploaded
Recently uploaded (20)
Get the Exact Identity Solution you Need in the Cloud - Deep Dive
- 1. HUBCITYMEDIA! Get the Exact IAM Solution You Need ! In the Cloud Deep Dive - Containerized IAM on Amazon Web Services (Webcast 2 of 3) ! HUBCITYMEDIA!
- 2. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. 2! Introductions
- 3. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. 3! Webcast 1 Recap Why Containerized IAM Customize the solution to meet ALL of your needs! ! ! Why Kubernetes Architecture, Deployment Landscape, ForgeRock DevOps! ! ! Containerized IAM on AWS Infrastructure, Product Configuration, Client Use Case ! ! ! Check out the recording of Webcast 1 - Link in Attachments! ! !
- 4. HUBCITYMEDIA! ForgeOps Recap: What is it?! Platform Configuration Strategy and Helm ! Demo: Deploying ForgeRock AM! Architecture Review: Cloud Deployments! Continuous Integration Strategies! ! Q&A! Monitoring Strategies! Kops and ForgeOps Customizations!
- 5. HUBCITYMEDIA! ForgeOps Recap The ForgeOps Repository provides demonstration Dockerfiles and Kubernetes / Helm artifacts ● You will need to modify these files for your environment Open Source - https://github.com/ForgeRock Yes - ForgeRock supports our products running in Docker / Kubernetes! (*) - ForgeRock provides commercial support for the platform (AM, DS, IDM, IG). We expect our partners / clients to have Kubernetes experience! 5 Copyright © 2018 ForgeRock. All rights reserved
- 6. HUBCITYMEDIA! DevOps Guide https://backstage.forgerock.com/docs/platform/6/ devops-guide/ Read the Fine Manual! Now with task flowcharts! 6 Copyright © 2018 ForgeRock. All rights reserved
- 7. HUBCITYMEDIA! ForgeOps Configuration Configuration is in json (a human-ish readable format)! Configuration needs to be provided to Amster / AM somehow...! ● We think production users will want to manage configuration in a git repo! ○ Allows for versioning, audit, rollback, etc.! ○ Potential for “gitOps” - deploy a new configuration when a git PR is merged! ● But other strategies are possible...! ○ Bake configuration files into the Docker container ! ○ Put them on an S3 bucket, NFS volume, etc.! ! 7 Copyright © 2018 ForgeRock. All rights reserved
- 8. HUBCITYMEDIA! Configuration Options 8 Copyright © 2018 ForgeRock. All rights reserved
- 9. HUBCITYMEDIA! 9 Copyright © 2018 ForgeRock. All rights reserved Helm Helm - A “package” manager for Kubernetes ! • Packages up Kubernetes manifests for an application! • Example: helm install wordpress Some helm commands: helm list - show the “releases” deployed to your cluster helm install - install a package. Creates a “release” helm delete - deletes a release
- 10. HUBCITYMEDIA! ForgeRock Access Manager Deployment Flow 1. Deploy frconfig chart (one time activity)! a. Holds the URLs and credentials needed to pull from a git repository! b. We might extend this chart in the future with other pre-requisites! 2. Deploy directories for configuration, CTS and user store! 3. Deploy Access Manager! a. It has a dependency on the config store ! b. Waits for config store to be available, then checks to see if there is a valid configuration! i. Create a bootstrap if there is an existing configuration. Otherwise - boot into configurator.! 4. Deploy Amster container! a. Amster spins waiting for AM to come up. If it is already configured, it does not reapply configuration.! b. Optional: Take exports from AM, commit them to git! For development: Iterate steps 2 > 4! Copyright © 2018 ForgeRock. All rights reserved
- 12. HUBCITYMEDIA! Sneak Peak: Our plans to simplify deployment Boot Access Manager directly from json configuration files! ● Eliminates the requirement for an amster bootstrap pod! ● Simplifies sequencing of bootstrap: No need to wait for a configuration store to be provisioned! ● No more “Install” Phase - there is just a “run” phase! Easier Secrets Management with Commons Secrets integration! ● Manage key material, admin credentials using commons secrets! ● Allow for “attaching” secrets per environment, instead of migrating them! ● Pluggable backend architecture! ○ Future support for Hashicorp Vault, or other secret backends! !
- 13. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Architecture Review 13! Automated Cluster Build! • AWS VPC! • Supporting AWS Infrastructure! • Kubernetes! • CI System! • Monitoring Infrastructure!
- 14. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Architecture Review 14! Continuous Integration! • IG/AM! • IDM! • DS via Config. Mgmt.!
- 15. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Core Infrastructure Build Processes 15! Stage 1 VPC! ! Parameterized CF Stack! ! Maps to Regional AMIs and Machine Types! ! Monitoring Stack! ! ! Stage 2 Kubernetes! ! Multi-AZ! ! Full Cluster Deployment! ! Customized AMIs! ! Stage 3 Applications! ! First CI run deploys apps! supporting AWS Svcs! ! !
- 16. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. 16! Node AMIs ! Customized for additional monitoring telemetry- Disk, CPU, etc.! ! NGINX Gateways! ! ! Docker Files ! Customized for additional monitoring telemetry – primarily JVM Stats! Sizing for production! ! K8s Deployments! ! Fully customized! ! No Helm! ! No Auto-scaling! ! ! MCS Ops Guide Tailored per client environment! ! ! HCM Kops and ForgeOps Customizations
- 17. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Continuous Integration Strategies 17! IG ! Fully Immutable! ! All config in Docker Image! ! Deployment and Roll back ! ! Elastically Scalable! ! ! AM ! Partially Immutable! ! Config in DS and Files! ! Elastically Scalable - Stateless! ! ! IDM ! Partially Immutable! ! Config DB/Files! ! Elastically Scalable! ! ! DS ! Not Containerized! ! Config. Mgmt. Approach! ! Ansible Automated build and updates! ! !
- 18. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Monitoring Strategies 18!
- 19. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Challenges 19! Networking and Kops Running Kops without Internet Gateway ! (one year ago)! ! ! Kubernetes plumbing can leak…or burst ! Proxies! ! Networking! ! Load balancers! ! ! Non TCP/ IP Services (RADIUS) NGINX! ! ! Managing configuration without consoles ! Big shift in thinking for application user! ! What is immutable vs. application data?! ! !
- 20. HUBCITYMEDIA! What you need before taking this on in AWS! FINAL WORDS!
- 22. HUBCITYMEDIA!Copyright © 2018 HUBCITYMEDIA. All rights reserved. Webcast Series POSSIBILITIES! ARCHITECTURE! DEVOPS! Thank you for joining us!! September 12, 2018! 2:00pm-3:00pm EST! 22!