Grouper Users - Open Discussion List

[Darren Boss <>]

If you are using Kubernetes then you can do this with secrets and config maps. Both secrets and config maps can be read from files which are then stored in etcd and can be mounted into the docker image as files so you don't have to bake them into the Docker images.

I've done this for Shibboleth IdP deployment and was planning to do this for Grouper as well but haven't got that far yet.

On Wed, Apr 25, 2018 at 1:03 PM Greg Haverkamp <> wrote:

On Wed, Apr 25, 2018 at 9:48 AM, Jack Stewart <> wrote:

I would like to start out by saying that the new role-based Grouper containers are great!  It was very easy to build the images.

Are you referring to the TIER image?

 

Now my question is, what are other schools doing with regard to their Grouper configurations?  Are you "burning them into" storing them in the containers themselves, or are you using secrets?

Converting an application like Grouper to use secrets would be a LOT of work.  Effectively, you would need to convert all of the settings to environment variables.  How would you deal with the sources.xml files which, by design, need to be customized?

We had just been wrestling with secrets-management, and I was mid-roll-out of Hashicorp Vault as a generalized solution.  So, in my current form, which I just deployed last week, I take the TIER image, use Docker Secrets to bootstrap the Vault credentials, and then use consul-template to present the secrets to Grouper.  I store all of the generated config files in a tmpfs volume, so they go away when the container is stopped.  I've got a few more tweaks, but I'm largely pleased with where it is now.

I decided to go the Vault route for a couple of reasons.  One was that I already had Vault running, though not actually doing much.  The other was that we have other plans for Vault and secrets management that Docker Secrets don't solve, in particular around dynamically generated secrets.  (Now that Vault can dynamically generate Google Service Account keys, I'm looking at modifying the google-apps-provisioner to deal with JSON files... That, or I'll write a consul-template plugin to write out a pkcs12 file.)  And finally, we didn't really want to be wedded to Swarm.  Swarm is conveniently for on-prem, but that's not where we see our future.

Greg

 

Many thanks,

Jack

--

Jack Stewart

Solutions Architect, Identity and Access Management

University of Michigan

4251 Plymouth Road

Ann Arbor, Michigan 48105-3640

(734) 764-0853

--

Darren Boss

Senior Programmer/Analyst
Programmeur-analyste principal

(o) 416.228.1234 x 230

(c) 919.525.0083

155 University Ave, Suite 302 Toronto, ON M5H 3B7
www.computecanada.ca / www.calculcanada.ca 
@ComputeCanada