Configuring the ForgeRock Identity Platform™ in a DevOps Environment- Shared screen with speaker view
Michelle Coppens :: Webinar Producer
Hello everyone and welcome to today's webinar titled manage configuring the for drunk identity platform in a DevOps environment.
My name is Michelle, I'm here to kick off the webinar. And we are so excited to have you here.
equally excited that earlier this month. Exit certified tech data was honored to receive the outstanding authorized training partner award from for jock for 2019. It's always a pleasure to partner with for jock.
Our speaker today is the TS lead instructor at Ford truck videos grew up in Germany, when he started his career as an IT instructor for Netscape and son before he moved to Norway.
There he met the founders of for jack and subsequently joined the company Mathias has has held several positions since then and now spends his time as for drugs principal instructor
Before we get started with the webinar. Let's cover the functionalities.
during the session. Everyone's microphones will be muted. So if you have any questions, please enter them in the Q AMP a box at the bottom of your screen.
post questions whenever they come up, we'll try to address them in that moment, but we're also going to have a dedicated question and answer session at the end of the presentation.
We're recording this session. And we're going to send a copy out to everyone. By early next week.
Also, I'm going to share a really amazing promo code at the end of the webinar, where you can save 50% on your for job training yes 50% stick around to look to learn a little bit more about that. Now let's get started with the webinar Mathias, you can take it away.
Yeah, very warm welcome from my side as well congratulations to exit certified as well for receiving this award. Well, very
Well oriented and I can say that from my side, I'm going to switch to my presentation now. Yeah. Thank you, Michelle.
My name is Mathias I am the instructor, the lead instructor from for truck.
I'd like to give you an introduction into how to configure for truck identity platform in a DevOps environment and of course the class, which we have developed over webinar.
What we call it the class, which we have developed for that. We just finished. Actually, it's the vision be of the class. We already run a class for almost
More than a year now in version eight but it has changed quite a bit, because for drug change their strategy on how to deploy into a Cuban 80s environment.
And therefore, we had to almost rewrite the entire class or I just showed you the legal page which is important, of course, here's my welcome page again.
And a little agenda. And so we're first going to look into the photo identity platform where a quick one. I assume most of you are very familiar with it anyway.
Then look into the photo cloud offering and the tools which are used there which will spend most of the time here.
And then I'd like to introduce you the classy or 4523 class, which basically covers the fortress cloud offering and the tools used in the various very similar way as I'm going to show it here just in much much more details, of course.
If there should be enough time after that. And then I also like to go into commercial mode of course and goofy a lot short introduction into what fortress university can also offer you, and you just heard about it. There is a promo code running right now.
Yeah, the fortress identity platform is comprised of access management identity management identity governance directory services identity gateway and edge security.
In our cloud offering. We are focusing on access management identity management and the directory services because those are the most critical components we have for deploying into the cloud.
The identity gateway, of course, is also very popular to be deployed in the cloud reschedule it is very straightforward.
The easiest property to do so if you are managing access management identity management that directory services in the cloud and
Using the identity gateway in the cloud is also pretty straight forward. The identity governance product is part of the Identity Manager. So if you manage to run the Identity Manager in the cloud and the identity governance is also there is just
Mentioned next to hear because it's the newest achievement. We have got an edge security. I guess that is an area which is not that interesting in the crowd in all for the cloud. So we're not going to handle that.
Now what does DevOps mean because in the documentation. We talked about it at food truck, we mostly just call it DevOps DevOps and what we mean. With that is Cooper natives. There are many
Cloud or even out of the cloud DevOps technologies around as a whole variety of tools and methodologies. But I said, in our case,
When we talk about DevOps or when you talk when you said, therefore, we mean communities. I believe one of the reason to call it DevOps sister that it is categorized in the right order or in the right places.
So I can definitely has a wide topic in for truck. It means communities came, it could have Cooper natives on Google Cloud on the Google Cloud platform on the Amazon Web Services in the Microsoft assure environment or mini cute.
There are other communities providers around as well. And we look into some of them and play with some of them, but this is the official list of supported coordinate is providers.
Well, good fortune DevOps also means, of course, is Docker well like Cuban 80s. We also decided that the only containerization software, we're using a Docker.
You also, of course, need to look into a load balancer into a DNS or public key infrastructure, when you want to go in production with your environment.
Having said that these are not the topics we're going to focus on here or in the class. We do a little bit of Docker because we're going to also create or
create our own Docker images which sooner or later you probably have to do but load balancers DNS and public infrastructure is not what we're going to talk to, to address there and I'll talk a little bit more about what we're not covering all what you have to be aware of.
A little bit later. So the food truck cloud offering
If you follow for trucks cloud offering for a while, then you are already familiar, probably with the cloud deployment model.
Which we have kind of extended with the cloud developer's kit. Now, and this is actually what you usually start with its wide is in the list on top of the list here.
We also provide our customers are interested people with some sample configuration.
We'll talk about tools and scripts. I will also show you where you can get all the good stuff because most of it is kind of open source in the sense that it is available through a good app repository, and you can just download and start playing with it.
You might want to start with documentation on the documentation is maybe not that easy to find, as it could be.
Well, depending on your background, maybe. So that's why I'm mentioning hit here. If you go to our famous backslash server and you can find the documentation. You can also find it product downloads there.
In the documentation part. There's documentation for am an IBM and all the other products and one area there is called for truck identity platform. And this is where you can also find the DevOps documentation.
So on the food truck identity platform, you will find DevOps, which is currently available in the version six five, which of course goes parallel with the version of the product. And there are a couple of slides. There is a start here guide a DevOps release notes.
Then results guides and then for cloud for the cloud developer's kit we have two guides the DevOps developer's kit using mini cube and the DevOps developers get using a shared cluster. Let me just have a
quick word about that will mini cube. If you're familiar with Cooper natives. You probably also know what mini cube is
We produced an extra guide for that. And if you want to run everything locally and have it just quick installed, that's perfectly fine.
Environment to play around with our offering when we also have the guide for the using a shared cluster. Why do we call it the shared cluster.
I believe we call the shared cluster, because the idea here might be that you have a couple of developers.
For which you create one pretty large maybe cluster in the Google Cloud environment for instance communities cluster.
And then the different developers can share that cluster for that develop meant work. And that's why we call the guide or the situation, the DevOps Developer's Guide for using a shared cluster.
If you want to get more serious on you're working towards going to production, then you definitely want to also look into the cloud deployment model, we had the cloud deployment model before and we have
Changed non so really changed, but we're even more emphasizing that
Deploying fortress, or any other software. This is not for specific deploying your services into the cloud is like deploying it on your operating system which is actually on that.
Machine under your desk. You also have to know what if you do that, you have to know
The features of your machine, you have to know the features of the operating system and a lot of things which are completely for drug independent
And the same is of course also true if you deploy as a communities or into a cooper natives environment only there's a big difference. And that is everybody's aware that, of course, for truck does not support the operating system you deploying to
With the cloud or with communities. This is a little bit different because it is so new, for a lot of us and it is so highly promoted.
In our industry and everybody says it's so simple, which it is, after a while, but you have to be
Aware that you don't get rid of the knowledge of the infrastructure. So you still have to have the knowledge about the infrastructure. If you're deploying your operating systems that is totally clear, you have to
Make sure that you're working system is secure enough and all this stuff around if you do that in a competitive environment similar requirements are there now with our first cloud deployment model, we might have concept to foreign so yeah we promote everything we
We support everything we didn't say that. But this was expectation, which we have created. So we have stepped a little bit back there. Its so called the cloud deployment model, but
It's the expectations which we right let's say it's a little bit less. Just do it, go into production and tomorrow and it fails.
While it's self healing. Yeah, it might be, but it may also not be okay. Having said that, we have an extra the deployment model guide for the Google offering for the Amazon offering and for the
Microsoft offering and we have a guide, which used to be called the site reliability guide and we used to have one extra one for Google, Amazon and
Microsoft, which is now renamed in the cloud, cloud deployment guide, because this is more what the guide is about and we only have one guide anymore for all the free environments.
Yeah, here's an actual other introduction about the CD k and the CDN on. Yeah. And what it is.
It comes actually as or if you want to look at it, you can download or clone a get repository get repository, which is called for jobs.
You can find it easily on GitHub. For instance, GitHub slash for truck and then you find a lot of quite a few
Repositories from fortress, obviously, and one is called forge ops. It has got some simple configuration all the new the Cooper natives manifest files all there and all. What you need to build your cloud deployment your communities deployment.
We also built a strategy for password handling, as I call it here on the slide.
What it is is another part which randomly creates passwords and it's actually more than one possible to create certificates for the different components to talk
To each other and also for the administrators, like the AM admin or the open item admin users to authenticate against am or IBM. So we automatically creating
Random password. So if you deployed into the cloud, they are kind of secure with random passwords and it should be only you, who should be able to get access to those paths with exactly what you mean here with a strategy for all password handling.
We decided to go away from home and instead use scaffold and customize. So there are scaffold configuration files as one for the six five deployment and one for the 7:30pm. This, of course, again, is referring to product releases from for truck.
And there is sample customization file to Joel's also partly split into six, five, and seven.
Why do I talk about seven seven is only released in a couple of weeks, but
The cloud strategy or the communities deployment is very, very similar now between 6.5 and seven.
So if you follow us on our coordinators deployment strategy for a while, then you may remember that we started with helm. But for some reason, we wanted to get rid of helm.
And so when they did the plot development for seven that decided to do everything we scuffle and customize that was so successful that our engineers decided that we kind of backed poor that strategy also to six, five, and therefore 6565 strategy was moved from LM into scaffold and customization.
And I'll have a word about what is scaffold and what is customization, just in a few minutes before that I'd like to give you a short overview. What is the CD clay. The cloud developer's kit.
Versus the cloud deployment model. So, as the name says the cloud developer's kit is for developers. And really, to start with, and start developing and you should very quickly have an environment
Which is already looking like for truck and it's for truck and you can connect to and you can start playing with it.
testing it out as well as starting to develop it.
And as I mentioned before, there is two strategies you can actually have it on the shared cluster here or you can even have it smaller or cheaper if you want in by deploying it into your mini cube cluster which you have running on your laptop, for instance.
So, you first need to create a cluster there. Once that is done. And this is kind of a prerequisite for the CD kV assume that somebody may be yourself or an administrator has created the cluster already
And you only need to deploy the for rock identity platform, which means basically you just download. The Four Tops get repository change directory into it run scaffold death.
If you run it against 6.5 you also have to specifically mentioned the scaffold F 6.5 PM, a file.
And then it deploys everything and everything should be fine and everything should be working. If you closer is big enough, let's say, and then you can access the platform, the UI and start playing with it.
So it's a minimal sample deployment for deployment purposes for development purposes. It includes that's mentioned
worth making includes fully integrated, am I meant directory server installs I go into the components, a little bit later as well. You may also find it there.
But it is only actually we basically only create the Docker image and we have commented out from the customization files already deployment of it.
But it is really straightforward. The question is just how do you use it and then you also need to have a resource usually which you want to protect with your it and therefore we took it out of that simple or straightforward deployment is big enough.
Is employed by developers who then access Am's and items you go a console and REST API's to configure the platform or to just play with the platform.
And the emphasizes really playing with the platform. This is way not production, not even benchmark ready now you don't run benchmarks on mini cube.
If you talk about the CDN. The main difference. Actually, I would say is we is this step here running light white benchmark. So the CDN is really an environment. Now, which should be good enough.
To run benchmarks against it. Now of course if you run benchmarks against it, then you probably also want to change the configuration.
You wouldn't want to rely on the configuration that comes in for drug, you of course have to get a configuration which is as close as possible to your configuration, the one you want to go into production with so
We need to set up or we need to have set up a cluster, maybe an administrator has set up a cluster for you already. If not, we provide you with some gloomy scripts, this time.
Which will create a cluster and we have three different clusters. And you may also again be familiar with that from the older model that is small, medium and large
Or small used to focus on 1 million entries medium and 10 million entries and large on 100 million entries
We don't use these words anymore or these dimensions anymore for small, medium and large, but you can roughly estimate that is what we have in focus.
For those three different sizes. So you need to create a cluster. And when you run your script to create the cluster, be careful because gloomy script you can feed actually can even start with the Mini. That is what we use in training honestly always small or with medium or with large
You might say, why not going large have everything have everything deployed and then you don't have a problem with sizing. Well, your credit card may have a problem with sizing or your bosses credit card because
The Google the Google all the other cloud providers will charge you quite a bit for that to be a bit careful when you run the script and look into maybe the
Gloomy script and check what is the size of the cluster, it will create for you. So having the cluster created
There's also an ingress controller, you have to take care and maybe a certain message you want to take care of. And then you can deploy the fortress around the platform. Again, which is
practically the same thing as we had in the cloud developer's kit. Just a configuration going to use is a little bit different. Again, but there's not that configuration, how
I am and am I configured is more about how much resources do you allow your part to occupy all the processes in your part to occupy and
Then the same next step is the same. You just access to us if you want or rest interfaces, if you want, and then you can start
Running little benchmark tests against them. We also have provided by the way with some sample benchmark testing tools as well.
And while you go into customization and end probably start here by deploying again on
To your testing can continue with your testing. And again, the CDMA School of course available for TK ek as an aka as the main differences. Anyway, how you create the cluster, but we provided with the blooming strips for GK e KS and aka es
I've got a bit of this comparison here between the CD and CD M.
Just very quickly, fully integrated am IBM and directory server installs yes true for both randomly generated secrets. Yes, true for both
Resource requirement well in names in the city. K. We expect you to work a lot with namespace. Because remember, we expect that you share the cluster with different developers and then the namespace concept of communities makes a lot of sense here.
And you can deploy it on GK IC s or ek is on mini cube which is a little bit different in this EDM. You probably also use namespace is of course a namespace, but it's not for separating different environments.
And then you use a dedicated GK IC s or aka so you don't share it with other developers, usually, otherwise you might face that noisy noisy neighbor effect.
Which you don't want when you do your benchmark tests, right, that will run a mini Cube City yes CM know
Mighty sound high availability world with a city K you want to save money. Right. You don't want to spend as much money as you might do for your production or your benchmark environments so
We don't do that with the city K with a CDN. Absolutely.
Replicate directory services with a CD chi. No, we don't expect that there is anything in your directory service which you need to have replicated Ohio available.
We want to save costs here. So no replication in the CD M. Of course, we want to have a high available environment and it's highly scalable environment. So definitely, yes.
Ingress configuration. Honestly, I don't exactly understand why the CD K would not need an ingress controller. It definitely needs an ingress controller. So I would give that a yes as well.
And the CDN. Yes, of course. Maybe you don't need an official Ingress controller, but I'll leave it up to you. Certificate management in the city. K. We usually use self signed certificates, which are just much easier when you deploy everything on
There. A little bit less easy. Of course, when the accident because your browser is actually complaining and it's more and more difficult with a browser these days to
Ask them, or well to to convince them that you know what you're doing and that they should accept those self signed certificates.
You don't have to handle it, you can handle it. But you don't have to handle it in the city K in the CPM, of course, you need to handle it.
Maybe providing your own certificates and finally Prometheus monitoring the funnel reporting and alert management, which is definitely something you
Want in your production environment so CDN yes of course city K, maybe not just because you want to save the space on the cluster. You could have intimacy DK as well, of course, and if it is just a test and develop your strategy on premium monitoring and reporting and alert management.
Here's something which might sound like a little bit too detailed for this kind of webinar here.
But if one or another of you would like to download and start playing with it without reading hours in of documentation. First, you might overlook that very easily and therefore I'm going to
Emphasize it will mention it here. I have seen it quite often that people forget that or not aware of that step and then you get errors when you try it out so
What we provide you in that forge ops gets downloaded or get cloud, which you may want to do is two parts where you can have for truck.
Directory for configuration and I'm talking about the AM configuration like adding a wrong or the IBM configuration like adding a connector and so on.
So there is actually I under the config. And then the version of the software and then CD K
Path. There is a complete set of configuration in the Identity Manager for instance.
It already has a connector configured to talk to one of the directory server that is also deployed, which we expect to have some or which is to be used as a user directory
That is actually a shared use the directory, the Identity Manager will provision, the users in there and the Access Manager will read the users from there to allow them to authenticate.
Via the Access Manager and that is especially important for seven because in seven the Access Manager and the Identity Manager will be automatically integrated when you deploy them as the CD clay.
Or in the context of the JDK, but this is actually the past which we expect to be under get control.
On the path. I'm showing here is actually the part that you get downloaded from fortress. In other words, there is evening and a good control of fortress. Well, you probably know
How you can change that by creating your own brand yourself. But this is not the path from where the scaffold deployment.
Would use the configuration because you may that orange part here called CD k, this is only one version that's come from photo but you might say,
I want to have my own configuration. I call it my CD clay or you might have different developers and they have different versions and they actually
At different stages. You want to deploy different versions or as we call them different profiles, where you get from for drugs at K profile and an hour to profile and then you can add your own profiles for testing different things and so
Now, how do you tell scaffold which profile, you want to use MVP. Be careful.
Those people of you who know scaffold already. You can also have profiles in scaffold. But that's not the profiles or exactly the prophets were talking
About technically they are independent. Those are kind of fortress profiles. Now you need a strategy to get to make them available for scaffold and this is what you do by copying them into the second part here, which is the
Path called Docker bicycle Docker because there you will also find the Docker false if you're familiar with scaffold, which a lot of you probably are, then you know scaffold is automatically creating
Docker images from Docker files. Now in contrast to our own strategy with Helm were the images would be deployed without configuration and then download when they
Are running as a part in Cooper natives, they would download the configuration about rooms and connected resources and so on from a get repository. That was the old version and the new version we bake the
configuration data rounds connectors and so on into the image and deployed with the image, and I believe that is much more the Cuban 80s style of especially Docker images style of doing things.
Now, in other words scuffled needs to have a Docker file that has the description, how to build a Docker container or the Docker image precisely on where to get this configuration. This is a key. What happens in that second path here and this is why the starting with Docker.
We have a command line tool which also get from the food ops repository, which can help you to maintain the copy here copy there between those two.
Paths where you can have your configuration. There is an in it or I call it initialize command here or an object to the command to the script which initialize is your Docker.
Configuration from one of the profiles you specify. Once you have done that you have it here and here. It may change. I will see him in white my change. And then you want to copy it back. And this is actually, we're done with the safe option.
You can also export from your cluster. And this is a provide may change here because if you want to, as a developer, if you want to use the admin UI of a Mr. IBM
You can still do so and you can configure a new realm through the admin UI. But then of course it is in Cuba natives in the cloud. Now you need to get it downloaded into that staging area as we as we also call it
And you can do that again with that little script which you get with the export command. Now you have it in staging area and then you would apply safe to copy it back or save it back into your profile where these and get control.
And if you want to combine the two commands, then you would just use a sink or the sync option so very convenient command.
Some more information about deploying the default CD came in the cloud developer's kit we have four different profiles scaffold profiles, actually.
One is called all the psyche, what you would do what you would use with the cloud developer's kit, the cloud, whether they're all profile is a profile which actually a can is done is done by default.
In the scaffold file or is used by default the default profile actually have the scaffold file.
And it has consequences on the customization strategy actually it has its path through the customization file where everything starts and it creates all the Cooper natives manifest files, all the communities objects.
And I said, the old profile is the one which is focusing on the CD K, you have a slide on. Yes, yes I do. If you look in the CDN well from left on the left hand side you already see
We're talking big now actually what we see here is the. It says here, the medium, but I believe it's the large profile the large profile has free sounds free aims to it, EMS
Free replica of the ID repo. It's a directory server or the CTS directory server. Well, I can't go into what's the difference between the idea or a pool and the CTS that would be Access Manager and Identity Manager stuff.
Which is not the focus, we have here. And I have to hold my own horses and not to go there because we don't have the time where we're not that bad. In time, actually.
So if you would run the medium profile, then you better have bigger bit of a bigger cluster because I said it will deploy.
Several am several IDs. By the way, the Postgres database here. It's called IBM Postgres. But it is fact. And while it is a is a more standard Postgres deployment, which we just uses a repository for IBM just to have them mentioned it also
Be ready to deploy Promethean escrow fauna and the alert manager. We don't do that automatically through the profile, but that cluster has been mentioned to also
Yeah, be ready for for deploying those
The cluster for you. Cloud developer's kit may not have the capacity to do that.
Yeah, and also is mainly always more or less automatic if you run the scaffold command, you can specify a profile under or
Couple of profiles in your scuffled Yama files as a default profile which is good for the cloud developer's kit. And then there are profiles, which you can use for small, medium, or large deployments.
prerequisites and key takeaways are now coming back to our
Can I call it the warning. Yeah, probably. So do not ignore the prerequisites outlined in the start here page, which is a whole guide these days.
They're not attempt to deploy for for guided path for them to production until you fully understand the DevOps technology.
Experience with the DevOps technology is critical to success and help is available for complex DevOps deployments of fortress software from for drug and for drug certified professionals.
Again, I'd like to compare that with the old days when we still had our own hardware and our own operating systems and
Had to maintain them and nobody actually would take would would would have a question about that this has to be done and that of course
For your hardware. You have to know somebody or you have to have somebody who knows a little bit about hardware and for your operating system. You know, it's
An administrator who knows quite a lot about operating systems and how to secure them and how to maintain them and how to make sure that they are working nicely.
With Cuba natives. It's still somebody needs to have that knowledge.
Good. If you have an in house if you don't have it in house, then you should definitely ask somebody. It's just if you download the food ops get repository. If you have a little bit of a cluster or you just read how to run the gloomy script.
On Monday, deploying and everything is fine. You might be happy.
And you go into production. And you might be happy.
Until something is not working anymore. And then you're in deep trouble. If you don't have the knowledge to debug it. We try to help you a little bit in the class. We have an extra lesson about troubleshooting.
But this is by far not enough to really enable you to run for truck or any other software in a kuvan it is environment and
Why do we emphasize so much on that because we just have had the experience that people are so tempted to try it. And then they expect
That for truck would support their communities environment which we just can't do. And we don't want you to be disappointed and only then find out that we are not supporting it. Okay.
Tools. I'm going to talk a little bit about communities Docker and Docker well very, very little scaffold customize Helm for meteors in Corona and Polo me
Of course, we don't have much time here. So I'm just actually mentioning. I hope you're all familiar
With containers, why we went from hardware to wait till operating systems to containerization. What's the difference between a Docker file a docker image and a Docker container maybe what we provide you with is the Docker files and some sample images. So we have a image repository.
Where you can download those scaffold automatically actually download those Docker images with am with IBM with the directory server installed ready to use in a development environment.
Not in a production environment. I heard in seven we might even provide you images which you can use in production, while you can use the existing images in production as well. But it really depends on your requirements.
If you expect that you have the latest security patches of Java of Tomcat and so on in the image right then I'm afraid you need to
Create your own images we are not doing that because there is very different requirements from different customers and how secure those images need to be
Inside. I heard in seven we may even go there that we provide support it images from our side but seven is not released yet. I can't tell you. I can only for, for me, it's, it's just and
How do you say, well, it's, it's just, let's call it rumors.
What we do support, interesting enough, is the Docker files. So if you need to know how to create those images and then it's your responsibility to make sure you use a Java version which is according to your let's say security requirements then
The Docker file which we gave you for all the products will help you to easily create those images and it is so easy that we can even do it in the class, we can handle it in class and this is one little lesson in the class, which only takes maybe I don't know 2030 minutes
Then we build our Docker files, sorry we build a docker image our own Docker images. So from that point of view, it is really straightforward.
It is just what exactly is in the image and is that something you can use in production, according to your own requirement. That's the big question that is left
Introducing scaffold scaffolding is a fantastic tool for continuous integration, continuous deployment, you can run scuffled even in a way that you say
Watch this directory contains my configurations and whenever a file in that folder. When that directory changes, then just really play everything I would almost say dangerous. The easy because I little control asked to safe.
A configuration from your editor.
Already causes everything to be redeployed which could be a bit
A lot for just actually saving something in between. And also, be careful when you do that, saving between you may even create your may even save
Configuration, which is not even ready to be deployed might not even be the correct syntax for that current configuration files in question here.
But people love it that you just actually plays a file there and everything's redeployed and you don't have to care about it.
You can also run scaffold in and run mode where he deploys everything and then he would wait for you to deploy it again.
You can look into the scaffold configuration files which we give you and he will find is comprised of three different areas if you want. There's build area. There's a deploy area. And there's a profile area.
The build area actually tells the scaffold itself, how to build those Docker images because this is what scaffold does whenever it finds a configuration change or whenever you tell it to do it, it will
Copy all the configuration from your configuration folder into the image, create a new image deploy the new image. By the way, if you want to accelerate the process. Highly recommended that for Google, for instance.
You can configure the whole thing so that it does the building of the images on Google. So you don't have to download the base image locally, create a new image and upload it into the cloud, everything happens in Google which accelerates the process a lot
Scaffold can be used to do the deployment with different tools but scuffle itself is not going to take care of the deployment, it will hand it over to another tool you can use home you can I believe you can use cube cuddled
As well directly, or you can use customized and that is actually what we have chosen to do this and then you configure actually in the deploy part
In the profile part you have the typical of build and deploy again.
And then when you run scuffled you can just tell it. Use this profile or your risk profile or another profile and will actually use those.
Instead of the default profile which is in build and deploy. Why not having that those profiles and extra scaffold files because in the profile section you can kind of refer to the default part. So if everything is the same except a different customization.
file you want to use. But the built part is exactly the same. You can just for the build part referred to the default and in the deploy part you can have a different deploy a part because you want to do it with a different customization talking about customization. What is customization.
Well, when you have those
Carbonate is manifest files.
Then they may be working totally fine. So you can deploy those customization files and everything is fine. Except you might say, well, wait a minute. In my case, I have a development environment, a test environment, the QA environment.
Some even have a production environment and should all be the same with little differences. For instance, the size of the VM for my directory service should be different or a couple of other configuration should be different.
Then customization or customize is the tool to use. By the way, this is not a typing error. It was already here, not a
typing error to spell scaffold with a K. The K probably comes because it is very closely related to Cuba natives and not to scaffold. Like, you may know the English word that is spelled with the sea.
Same is fully customized other case probably stands for communities and not for customized like in English word customization. Well, anyhow. This just actually side remark.
Yeah, customize. I said, can be run again with different customizations. And you just actually specify different customization files or different so called over lace and then almost the same configuration will be used to create those communities manifest files with just some small differences.
Because most people had one requirement when they built customers. And that is, it should be template free so the basis on which you create your real configuration is
Not a template like it would be in Ellen, for instance, but is a complete full working configuration you just overwriting parts of it.
And you do that by using a technology. It's a little bit similar to expose except of course in Yarmouth file and well as possible and work, but from the idea. It is actually you have a an exact
Path like a your I even the customers in the coordinate is manifest photos or hierarchical files. So you can have a UI that exactly points to one particular parameter and you can just override the value instead of having a variable name which is replaced during the build process.
Why is that so smart, because sometimes you want to go in the other direction, you have something deployed already a configuration deployed on the server where the
Variables are replaced by the default. And when you export it. It will not reverse and replace the values with the variable names again. Right.
Which would actually destroy your customization, this time with the sea spelled with the sea idea of replacing variables during deployment. So
Very, very cool tool. Um, I would almost say it's it's unfortunate that it only works with yellow files because I would like to use it in almost everything.
Now, okay, Tony, very quickly about polygamy polygamy is a script language and I'm really very brief here which we use to create clusters in our coordinators environments.
There are two steps to have to do you first use what we call infra which actually kind of prepares the infrastructure. So it will create a CPV I and was CPB stands for virtual
Okay, sorry. I have a bit of a blackout. Now we're to a private cloud. I guess that's what it translates into
So it's a bit like like a virtual private network runs over the internet. But you likely do it in a way that it is virtually private and the same exactly true with a virtual private cloud.
It of course runs in the cloud provided by Google or Amazon or Microsoft, which is everything else than private but via truly it is private.
And you have to create that kind of infrastructure first before you can create a cluster. And this is what the second
part does. It's called stack. But what it does, mainly it creates a cluster and that cluster can then be distributed over def different regions and sound. This is why you need the Virtual Private cluster.
Technology here if we also reserve that IP address for ingress controller very convenient and it creates storage which some may need and the last slide of this section already is.
Some other component while summarizing everything which will be deployed the others answer.
I'm sorry, using actually this is six, five, and six five is still need to answer to, if you're familiar enough with am to import the configuration into the directory server for the
Access Manager and we use our own command line tool for that answer, then there's am there is I am there to directory servers as a Postgres database for IBM and that there's a report which is creating those random
Secrets passwords for some of the objects we need persistent volumes. So we have the persistent volumes here.
In addition, you need an ingress controller. We are using engine x here with a particular configuration.
And a certain managers or the ingress controller is so we have a front end the reverse proxy. If you don't know what an ingress controller is in Cuba natives. So it works. Kind of like a reverse proxy.
And you need that to access it from outside and the CERT manager you need if you want to not use self signed certificates, but
Let's Encrypt certificates or real certificate from a certificate authority self signed certificates. You don't necessarily need it because I believe the English would also that engine x, we are using for the English would also do it for monitoring, you can use primitives and
This is important dimension because from the footer point of view. So all of this here is customized deploy deploy using customize
for monitoring the service manager and the engine x we use standard deployments and they are so easy to get through existing Helm charts. Right.
We give you more help. We created scripts, which deploy all of that. But what those scripts do they're still referring to those Helm charts.
And that's the only reason why you find the key word Helm still in our documentation, not for any for truck deployment. That is all customized now but for that port.
Michelle How much time do I have minus five minutes already.
Michelle Coppens :: Webinar Producer
We have 10 minutes
Okay, good. I thought I should
leave some time for questions.
But okay 10 minutes for my presentation or 10 minutes for the whole webinar.
Michelle Coppens :: Webinar Producer
10 minutes total and we have about five questions queued up
Okay, good. That's five minutes. So I have five minutes for the class well
It can be done very quickly because what I explained actually most of the slides were just taken from the class right
So I don't have to talk too much about the class because we just do all that in the class. What I just tried to explain. Let's go to the summary, we have a description about the class and target audience. Some prerequisites. And what's the use case. So
Transcription successfully deploy and manage the force for good ad platform software in a coordinated cloud environment running on Google coordinators environment using DevOps techniques.
This is what we do in the class or lead is the goal of the class. Honestly, it happens in the first couple of hours that everything is deployed.
It could actually be done in 10 minutes because we give you an environment where you basically have to run one command and then everything is deployed. But of course, this is not
Where you learn a lot. If you just run a command and everything is deployed automatically. So it is we have to go into the details, a little bit. And at the end of the first
Day we already have a chapter which is called troubleshooting so good for the instructor, because if things go wrong. Oh, go go go go south in the in the first deployment attempt
Just the better because then everybody's looking forward to the troubleshooting chapter where honestly. Usually, it doesn't happen so
What happens is everything just runs smoothly. Not always. I just run a class like last week. We're we did have trouble, which was actually due to some
Things we don't have under control and basically the interesting part. It's called instructor led workshop
It is a little bit different from the structure than the classes you may have visited with for truck so far, where you have a student guide.
Which is the instructors presentation and the student workbook, which is very detailed instructions on what you should do in the labs and it's totally separated. There is
A presentation and then you have an hour or 30 minutes or however long
It may take for doing the labs and you're doing the labs, pretty much on your own, with the help of the instructor. Of course, if you need it.
Now, we call this a instructor led workshop, because there is only one presentation and the labs happen within that same presentation and for the labs, there is only the presentation. So there's not that much detailed
Instructions honestly the instructions or detail enough that you only have to type or even copy paste. What is on the slides, but there's not all the explanations are around it. This is actually what we expect those instructors to give you a while or in between you, or doing the labs.
And that makes it much more interactive and other classes.
Because there is no defense lab guide on then people are much more
Open to ask questions.
Target Audience developers who customize and deploy a food truck, the platform. Remember, it's the Access Manager, the identity mentioned directory server. And if you want the identity gateway as well.
Deployment engineers who routinely set up communities clusters and deploy integrated software in the cloud. So
Those people who are already familiar with playing with Cooper natives side engineers who configure the Cooper natives cluster and who launched the platform into production might also be interested to know what they are going to put into production here.
We do expect some knowledge about Docker communities.
Chica de, why not Amazon or Microsoft because we run everything on GK II, but since it is Cooper natives. Most of the commands or agnostic of the cloud provider anyway.
scuffled customize skit. Follow me remember Helm is needed if and we do that do that. You want to deploy an ingress controller and a Certificate Manager and the monitoring infrastructure.
You don't have to have a lot of knowledge of all of this, it is just if you are very new to all of these. It's a lot. It's just
Really a lot to learn in three days and then you may end up in an information overflow situation if you are familiar with.
Docker, but not scaffold. You will pick up scaffold probing during the class. If you're familiar with scaffold, but no customization or customized you will pick up customized
During the class, so I'm not worried that you will get through the class or that you won't learn anything. It's just said it might you might if you're
pretty new to everything of the you might pretty much certainly end up in a information overflow situation. What we of course also expect is that you have a little bit of of knowledge about our own software. So ideally, you have visited or similar knowledge like is provided through the
And IBM 400 clauses and of course if you have been to the it for the class not harmful little
Bit about Linux could be interesting, or could be useful, because we are running the commands from a Linux environment.
The commands that while this is all the cluster client commands like cube cuddle or in our case G Cloud is the Google Cloud SDK.
Or scaffold and all that all these programs or all these programs have to be on the client side also installed with a client.
And we provide you with a Linux machine where everything is installed. If you don't like that will be our guest install it on your own laptop, but that is not part of the class.
And that's actually why we would like everybody to have a little bit of Linux knowledge.
They use goes will understand how for drug software can be deployed using DevOps techniques which basically means communities. Right.
Determine which requirements are necessary before deploying for for software, you will learn that learn the overall process for deploying fortress after using different techniques. Again, mainly communities. We do do a little bit of kit and have a little bit of hints on how you can
Organize Your get repositories for development.
Testing QA hands on.
And then quickly deploy the full truck identity platform software for evaluation purposes.
The agenda, we have five chapters and I'd like to
Well, as far as I remember, without going through the chapters in detail, chapter one, introducing the photo galanti platform and deploy a death of example we are basically following the
Cloud developer's guide here. In other words, we're deploying everything. It's a really poignant moment, but we don't care about
Am configuration or IBM configuration here, but this is remember the chapter where we also do a little bit of troubleshooting.
Then chapter number to configure the fortress identity platform sounds very similar, doesn't it, but here we are now more focusing on the CDN. We want to introduce our own configurations like rooms and connectors and all this stuff.
Then deploying a VM configuration of the platform. Here we are going, actually.
Put that together with deploying a platform to multiple environments topics here are create your own cluster monitoring.
How we create those secrets that in that and how you can deal with these randomly created passwords. So those are the topics we're going here. So we're going really a bit into the details of what we are deploying and what we're doing and some topics around it.
And finally, migrating and application to communities and application is if you have been to one of our other classes, you know that very well. The food truck entertainment company, they have that application.
Where you can stream movies and stuff and they have at the end of those classes. Everything is deployed it. Mm hmm. And I G and everything is ready to go into production.
For streaming movies with the customers and that is all on premises. Now they had the idea to also move that into the cloud. And this is what we are handling in chapter number five, chapter number five. We handling all the topics.
Which you have to think about when you want to move from on premises into cloud deployment. Well, if I said all the topics, the FCC topics. Right.
Your installation might be a little bit different. And you might have requirements which don't cover here. So it is really a start. For those who want to know what might have to be done when you move from on premise into
The cloud. And then of course it depends on how customized solution is whether everything you need, you will learn here or whether there are some extra steps. Okay. Having said that,
About future university we have those kind of four different levels as the 100 level class which we are currently rewriting and they will be re recorded. They actually are provided for exit certified in the future. And you can actually, yeah.
Just visit the class there. The 400 level classes or the deployment classes where you learn the basics was not so basic but five days for each product. How you deploy.
Them the 500 level classes or these expect a instructor led expert led workshops
We have to the one we're talking about here, and the one about identity governance and finally the 600 level class, we only have one at the moment. And this is a combination of the AM and the ID and plus. With that, thank you very much. We're not done because there are questions.
Michelle Coppens :: Webinar Producer
There are a ton of questions in the Q AMP. A but just looking at the time. I want to let everyone know that I posted a few really useful links in the chat window for everyone.
If you are. I mean, you're here for FR 523 right now I want to let you know that our July six classes guaranteed to run. So not only will you be able to enroll at 50%
Off, but you can also guaranteed to get your training in on July 6 I've linked all of our other for job training classes when you're looking at the schedule look for that GT R symbol to know that your classes guaranteed to run from now through the end of July, we have
At least one class for each course guaranteed to run. And I also shared the 50% off promo code as well as the details, you can find all of those useful links in the chat MTS is sharing
A similar slide to but find the clickable links in the chat window. Alright Mathias, do you have the Q AMP a box open
I do awesome
First one is Oracle Cloud support it to support it. No, we have looked into it.
But we also found it a little bit difficult, as far as I know.
So I said, we have looked into it, but I don't think it's well I know it is not so officially supported it might be, but not at the moment.
Just the deployment is supported and recommended even in client environment.
Or didn't require a dedicated to when it is cluster.
I don't think you want to share the cluster with some other software.
I wouldn't know why it shouldn't be supported. I guess he would rather easily run out of resources or unexpectedly running out of CSS is because
You know how it is incriminated you really give the authority to organize which process is running on which node.
To Cuban 80s. Right. And then if you mix it with other software. It could be. Well, I would say it's isn't it complicated enough to to have a cluster, just for for truck what complicated enough is not the right way to say, of course, but
challenging enough. But if you don't install the, the, the full stack. I wouldn't know why you shouldn't do that.
We are definitely supporting that we are a lot of our customers want to do that. And I believe, in many cases, it should be the way to do because we're talking about identity management, which means personalized data of your users or your employees.
What we have for instance created as a little Goodie, you might be interested in, in which will come out in seven
Is a new connector server. If you're familiar with IBM there's a connect to server, which you can run in IBM or you can run as a remote server. So usually
IBM uses the connector server to connect to external systems. Now if you run a non a hybrid situation you might have IBM in the cloud, but it needs to connect to your directory server.
On the on premises and that would mean you have to allow somebody from outside to penetrate your firewall, which is not really popular with the firewall people so
We have looked into what we can do here. And we actually created a connector server that would run on premises and from the connector server.
Open the connection to IBM so IBM can access your Active Directory, for instance, I just mentioned Active Directory, because it's a popular one for the situation.
So this just as a that might answer your question, I can't talk more about it, but it is definitely on our
One of our focuses the hybrid cloud is very important for us because we know that many customers want to do that. We also see the fully see the reason why you want to do that and we taking care of that on. I just mentioned one example for that.
What is all profile meant. Yeah, I am. I like the question because I also almost wondering if if you go to a restaurant and order a pizza with everything. Does it mean, nobody else will get a pizza.
Because you've got everything. And that's a little bit with the also all precisely means am IBM to directory servers and a Postgres database.
And then you could of course could also strip it down to say I'm don't need an Identity Manager. I only need an Access Manager. Oh, I only need an Identity Manager, but no Access Manager or I only needed directory server.
And there's another question. What about deploy on AWS instead of Google as our production is neither yes yes AWS, I believe we have minimum as many customers on AWS or interested in AWS then Google
I agree. Oh, I accept my slides were a little bit Google centric just for the simple reason that the training runs in the Google Cloud, right, but from fortress point of view, we support AWS and Google in exactly the same way.
As sure we have a little bit more difficulties because I believe Asia is a little bit behind in the communities deployment world, right, at least, it used to be. I don't have to
admit, I haven't looked into it for the next couple of weeks, a month, but I had the impression. They were a little bit being and we had a little bit of extra trouble with them getting every thing sorted, but I believe a lot of things are definitely sorted now.
Yeah but AWS. Absolutely.
Equal to Google.
Well, why the CDMA advises the CDMA is a robot sample deployment for the inspiration and exploration purposes only. It is not a product deployment in this deployment document.
The reason or can I try to have a short answer with out. I already tried to mention it. The point is, we, we, and we still say that the CD M is a blueprint.
Or a reference model, but we called it ready for production and unfortunately a few customers with not enough knowledge in Cuba natives said okay
If this is what I need for production, then I don't need all the knowledge and I just do it right and you know how it is in our industry, you can
Still run into trouble. And then you have to have that background knowledge. So we just want to avoid that people believe it is that easy as it can be. In the first run well by following the CD and and therefore we just started to avoid mentioning production.
But the only reason is that we want to avoid that people be if this is all they need to go into production and they don't need to have all the background knowledge and you also know how it is in our industry.
Especially our software we try to go by not go away for it, but make it easier
To deploy our software with less customizations. But this is what. On the other hand, people love with our software as well because you can customize it so much.
And then of course you have your customized am and deploy with a CDN and it suddenly beliefs or suddenly you find situations which we didn't think about maybe when we created the CDN.
Or tested the CMO so so that's the the the background for that.
Oh no open questions anymore.
Michelle Coppens :: Webinar Producer
It looks like. That's where we're at, for questions. Once again, thank you so much Mathias. Thank you.
For everyone for attending today. As a reminder, we've recorded this session. And we're going to send a copy out to everyone early next week. I do take advantage of those classes on a schedule that are guaranteed to run and if you have any more questions. Now's a great time.
Otherwise, I hope you all enjoy the rest of your day. Thank you much, yes.
Thank you, Michelle.
Powered by Otter.aiTM