Skip to Content.
Sympa Menu

grouper-users - Re: [grouper-users] Containerized Grouper and Secrets

Subject: Grouper Users - Open Discussion List

List archive

Re: [grouper-users] Containerized Grouper and Secrets

Chronological Thread 
  • From: Jack Stewart <>
  • To: Darren Boss <>
  • Cc:
  • Subject: Re: [grouper-users] Containerized Grouper and Secrets
  • Date: Wed, 25 Apr 2018 16:26:57 -0400
  • Ironport-phdr: 9a23:FBiIoRYUYATVuVgmlJdDA/D/LSx+4OfEezUN459isYplN5qZrs+7bnLW6fgltlLVR4KTs6sC17KN9fi4EUU7or+5+EgYd5JNUxJXwe43pCcHRPC/NEvgMfTxZDY7FskRHHVs/nW8LFQHUJ2mPw6arXK99yMdFQviPgRpOOv1BpTSj8Oq3Oyu5pHfeQpFiCazbL9oMBm6sRjau9ULj4dlNqs/0AbCrGFSe+RRy2NoJFaTkAj568yt4pNt8Dletuw4+cJYXqr0Y6o3TbpDDDQ7KG81/9HktQPCTQSU+HQRVHgdnwdSDAjE6BH6WYrxsjf/u+Fg1iSWIdH6QLYpUjm58axlVAHnhzsGNz4h8WHYlMpwjL5AoBm8oxBz2pPYbJ2JOPZ7eK7Sc8kaRW5cVchPUSJPDJ63Y48WA+cBOOpVqZT2qVkTohukHQSjBu3vxD9GiHH1wKM0zfguHBrc0wA8Bd8DqmjYoMn3OaoUTOu7zLPIzTLGb/5O3Tny8pTHchM8qv+RQbJ/b8TQxlM1FwPZk16dronlPzGO1uQRrWea4fFtVf+qi24mtw5xoiKjydkxhYnUn48YzE3P+yt+wIYwP9K4SUh7bMa4H5RKsyGVK5Z2Qsc+TG5yviY10KAJtoShcCcW0psr3xHfa/uAc4iH5hLsSvydLit/hHJgYL6wmxGy8U24yu3hSsm7zkpFoTBDktbWq38CzQbf5dSdRfZ740yv2i6P2hjN5uxFPUw5l6/WK5Aiz7EripYetEvOEjPqlErriaKZalko9fWt5unifLnrqZCROolpgQ/kKKsugNawAeEgPwgOQWeb/eO82aXm/ULjQbVKiuQ6krDFsJzGPMgaqbC1DgBa34o55Ba/CDCm0NscnXYZNl5KZBWHj43xN1HPJvD3E+u/jkyynDpq2/zLPLjsApvOI3fYjLvseLlw51JAxAUuyN1Q+45YBawELf/2REP8u9PVAgc8MwOuwubnDNt91pkZWWKKGqKZNaHSsUSU5u0xLeiBf5IVuDP8K/c55/7il2E2lkIAfaWxx5sYdGi4Huh6I0WeeXfsjc0BEWAXvgomUuPqkkSOUSNIZ3msRaI8/So2CIanDYfYWoCtm6KN0D26Hp1QemBJFEqMEXH2eIWYRfsAcjydLdJ8km9Mab/0Z4Y7zxyo/CX90KEveubd4DcVs9Tp08Nuz+bUkAkv6TF/BsKU32jLRGgizU0SQDpj/ql0ogRG1lqc2LJky6hdF8dP6uxhTwI7Pp6awuBnXYOhEjndd8uEHQ71Cu6tBis8G5dom4ID


Right now I'm liking the S3 bucket idea.

But, while I know AWS EKS (Elastic Container Services for Kubernetes) is a while off, how do you think this would look in AWS?

Thanks, Jack

On Wed, Apr 25, 2018 at 3:44 PM, Darren Boss <> wrote:
If you are using Kubernetes then you can do this with secrets and config maps. Both secrets and config maps can be read from files which are then stored in etcd and can be mounted into the docker image as files so you don't have to bake them into the Docker images.

I've done this for Shibboleth IdP deployment and was planning to do this for Grouper as well but haven't got that far yet.

On Wed, Apr 25, 2018 at 1:03 PM Greg Haverkamp <> wrote:
On Wed, Apr 25, 2018 at 9:48 AM, Jack Stewart <> wrote:

I would like to start out by saying that the new role-based Grouper containers are great!  It was very easy to build the images.

Are you referring to the TIER image?
Now my question is, what are other schools doing with regard to their Grouper configurations?  Are you "burning them into" storing them in the containers themselves, or are you using secrets?

Converting an application like Grouper to use secrets would be a LOT of work.  Effectively, you would need to convert all of the settings to environment variables.  How would you deal with the sources.xml files which, by design, need to be customized?

We had just been wrestling with secrets-management, and I was mid-roll-out of Hashicorp Vault as a generalized solution.  So, in my current form, which I just deployed last week, I take the TIER image, use Docker Secrets to bootstrap the Vault credentials, and then use consul-template to present the secrets to Grouper.  I store all of the generated config files in a tmpfs volume, so they go away when the container is stopped.  I've got a few more tweaks, but I'm largely pleased with where it is now.

I decided to go the Vault route for a couple of reasons.  One was that I already had Vault running, though not actually doing much.  The other was that we have other plans for Vault and secrets management that Docker Secrets don't solve, in particular around dynamically generated secrets.  (Now that Vault can dynamically generate Google Service Account keys, I'm looking at modifying the google-apps-provisioner to deal with JSON files... That, or I'll write a consul-template plugin to write out a pkcs12 file.)  And finally, we didn't really want to be wedded to Swarm.  Swarm is conveniently for on-prem, but that's not where we see our future.



Many thanks,

Jack Stewart
Solutions Architect, Identity and Access Management
University of Michigan

Darren Boss

Senior Programmer/Analyst
Programmeur-analyste principal

(o) 416.228.1234 x
(c) 919.525.0083

Jack Stewart
Solutions Architect, Identity and Access Management
University of Michigan
4251 Plymouth Road
Ann Arbor, Michigan 48105-3640
(734) 764-0853

Archive powered by MHonArc 2.6.19.

Top of Page