Grouper Users - Open Discussion List

[Darren Boss <>]

I have not played with EKS but I do know some other companies around the Ottawa area that are although Shopify moved to GKE in a very public way. You can always deploy K8s into AWS if EKS is still rough around the edges on your own but that's becoming a larger commitment to K8s at that point.

As for how we are deploying at Compute Canada, we are building our own K8s clusters on top of OpenStack (which we also deploy on our own hardware) at the moment, something you could do on Jetstream for example.

We are interested in Vault as well, for both K8s deployed application and in conjunction with our Puppet deployments but we aren't quite there yet.

Once we have something getting closer to production worthy I'm interested in sharing some of the yaml k8s assets with the community if there is interest. I could see having a Helm deployment of Grouper at some point.

On Wed, Apr 25, 2018 at 4:26 PM Jack Stewart <> wrote:

Darren,

Right now I'm liking the S3 bucket idea.

But, while I know AWS EKS (Elastic Container Services for Kubernetes) is a while off, how do you think this would look in AWS?

Thanks, Jack

On Wed, Apr 25, 2018 at 3:44 PM, Darren Boss <> wrote:

If you are using Kubernetes then you can do this with secrets and config maps. Both secrets and config maps can be read from files which are then stored in etcd and can be mounted into the docker image as files so you don't have to bake them into the Docker images.

I've done this for Shibboleth IdP deployment and was planning to do this for Grouper as well but haven't got that far yet.

On Wed, Apr 25, 2018 at 1:03 PM Greg Haverkamp <> wrote:

On Wed, Apr 25, 2018 at 9:48 AM, Jack Stewart <> wrote:

I would like to start out by saying that the new role-based Grouper containers are great!  It was very easy to build the images.

Are you referring to the TIER image?

 

Now my question is, what are other schools doing with regard to their Grouper configurations?  Are you "burning them into" storing them in the containers themselves, or are you using secrets?

Converting an application like Grouper to use secrets would be a LOT of work.  Effectively, you would need to convert all of the settings to environment variables.  How would you deal with the sources.xml files which, by design, need to be customized?

We had just been wrestling with secrets-management, and I was mid-roll-out of Hashicorp Vault as a generalized solution.  So, in my current form, which I just deployed last week, I take the TIER image, use Docker Secrets to bootstrap the Vault credentials, and then use consul-template to present the secrets to Grouper.  I store all of the generated config files in a tmpfs volume, so they go away when the container is stopped.  I've got a few more tweaks, but I'm largely pleased with where it is now.

I decided to go the Vault route for a couple of reasons.  One was that I already had Vault running, though not actually doing much.  The other was that we have other plans for Vault and secrets management that Docker Secrets don't solve, in particular around dynamically generated secrets.  (Now that Vault can dynamically generate Google Service Account keys, I'm looking at modifying the google-apps-provisioner to deal with JSON files... That, or I'll write a consul-template plugin to write out a pkcs12 file.)  And finally, we didn't really want to be wedded to Swarm.  Swarm is conveniently for on-prem, but that's not where we see our future.

Greg

 

Many thanks,

Jack

--

Jack Stewart

Solutions Architect, Identity and Access Management

University of Michigan

4251 Plymouth Road

Ann Arbor, Michigan 48105-3640

(734) 764-0853

--

Darren Boss

Senior Programmer/Analyst
Programmeur-analyste principal

(o) 416.228.1234 x 230

(c) 919.525.0083

155 University Ave, Suite 302 Toronto, ON M5H 3B7
www.computecanada.ca / www.calculcanada.ca 
@ComputeCanada 

--

Jack Stewart

Solutions Architect, Identity and Access Management

University of Michigan

4251 Plymouth Road

Ann Arbor, Michigan 48105-3640

(734) 764-0853

--

Darren Boss

Senior Programmer/Analyst
Programmeur-analyste principal

(o) 416.228.1234 x 230

(c) 919.525.0083

155 University Ave, Suite 302 Toronto, ON M5H 3B7
www.computecanada.ca / www.calculcanada.ca 
@ComputeCanada