IAM Demo

Identity and Access Management (IAM) demo infrastructure.

• 📜 Introduction
• 🐣 Getting started
  • ⚙️ Setup
    • Dependencies
    • Run
  • 🔧 Development
  • 💻 Linux desktop VM
    • Connect using Remote Desktop
    • Test self-signed certificates
    • Complete Setup (required to run only once)
      • Configure environment variables and shell completion
      • Configure Gitea ssh keys
  • 🧑‍💻 Access Kubernetes cluster
    • Connecting from the console
    • Connect using linux-desktop browser
      • Traefik Dashboard
      • Kubernetes Dashboard
• Troubleshooting
• TODO
• 📄 License

📜 Introduction

Use Multipass to start an ansible controller instance, a Kubernetes cluster, and a linux desktop with Xfce Desktop Environment.

🐣 Getting started

⚙️ Setup

Dependencies

• Jsonnet
• Multipass

Run

./bunch-up -a

🔧 Development

See development documentation.

💻 Linux desktop VM

Connect using Remote Desktop

Use any RDP client (like Microsoft Remote Desktop or FreeRDP) to connect to the linux-desktop virtual machine.

• user: iamadmin
• password: iamadmin

The IP Address is the first entry from ipv4 when running the following command:

./platform/vm-generator/generated/vms-status.sh linux-desktop

Test self-signed certificates

The ansible scripts should have installed the self-signed root certificate inside the linux-desktop virtual machine.

To test that the services are running and using the proper DNS and certificates, open a terminal in the linux-desktop VM and type:

~/bin/check-vm-config.sh

Complete Setup (required to run only once)

Configure environment variables and shell completion

Open a terminal and type:

# Configure iam-demo-tech k8s cluster as default
echo 'export KUBECONFIG=~/.kube/config-iam-demo-tech' | sudo tee --append /etc/bash.bashrc
# Add kubectl completion
kubectl completion bash | sudo tee /etc/bash_completion.d/kubectl
# Add kustomize completion
kustomize completion bash | sudo tee /etc/bash_completion.d/kustomize
# Add helm completion
helm completion bash | sudo tee /etc/bash_completion.d/helm
# Open a new shell tab or start a new shell to apply the changes
exec $SHELL

Configure Gitea ssh keys

Open a terminal to generate the ssh keys.

ssh-keygen -t ed25519 -C "iamadmin@iam-demo.test"

Open a Gitea in a browser and login using the credentials from Connect using linux-desktop browser.

Open a terminal and copy your public ssh key in the clipboard.

cat ~/.ssh/id_ed25519.pub | tee >(xclip -selection clipboard); echo ''

Open Manage SSH Keys in Gitea in a browser and paste the public key.

🧑‍💻 Access Kubernetes cluster

Connecting from the console

Access ansible-controller shell using:

./platform/vm-generator/generated/vm-shell.sh ansible-controller

or connect to linux-desktop using Remote Desktop and open a terminal.

You can also access linux-desktop shell using:

./platform/vm-generator/generated/vm-shell.sh linux-desktop

To check the Kubernetes configuration, type:

kubectl config view

The output should be like the following:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://iam-control-plane.iam-demo.test:6443
  name: default
contexts:
- context:
    cluster: default
    user: default
  name: default
current-context: default
kind: Config
preferences: {}
users:
- name: default
  user:
    client-certificate-data: DATA+OMITTED
    client-key-data: DATA+OMITTED

The kubernetes folder is mounted inside the ansible-controller under /kubernetes.

Connect using linux-desktop browser

Connect to linux-desktop using Remote Desktop.

Open Firefox inside the VM, and use the following URLs: (Note: you can find them in Firefox bookmarks)

• Grafana: https://grafana.iam-demo.test
  • user: admin
  • password: grafana-admin
• Gitea: https://git.iam-demo.test
  • user: gitea-admin
  • password: giteapw123!
• Prometheus: https://prometheus.iam-demo.test
• Alertmanager: https://alertmanager.iam-demo.test
• Consul: https://consul.iam-demo.test
• Keycloak: https://keycloak.iam-demo.test

To access Traefik or Kubernetes dashboards, follow the instructions in the respective subsections.

Traefik Dashboard

Open a terminal and start port forwarding using:

kubectl port-forward \
  --namespace kube-system \
  $(kubectl get pods \
    --namespace kube-system \
    --selector "app.kubernetes.io/name=traefik" \
    --output=name) \
  9000:9000

Open http://127.0.0.1:9000/dashboard/ in a browser.

Kubernetes Dashboard

Generate a token, print it and copy it to the clipboard:

kubectl -n kubernetes-dashboard create token admin-user | tee >(xclip -selection clipboard); echo ''

Start the proxy:

kubectl proxy

Access the board in a web broser opening:

http://localhost:8001/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/

Troubleshooting

• Troubleshooting

TODO

• TODO

📄 License

Distributed under the terms of the Apache License (Version 2.0).

See LICENSE for details.