Red Hat OpenShift GitOps Guide to the Galaxy | Red Hat Livestreaming, 26 Aug 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GitOps Guide to the Galaxy (Ep 21): RBAC Revisited

Description

Failure is not an option! We revisit the subject of Role-based access control (RBAC) with three, yes count them THREE, different patterns. We will be taking a look at SSO, Authentication, and Git workflows approach to RBAC. So join us to learn more about the dynamic duo of GitOps and RBAC.

If you missed the previous episode about RBAC, watch it here: https://youtu.be/XsiPPjnKFGw

Follow us:
Christian Hernandez https://twitter.com/christianh814
Chris Short https://twitter.com/ChrisShort

What is GitOps Guide to the Galaxy?
Every other Thursday at 3pm ET hosts Christian Hernandez and Chris Short sit down to discuss everything in the GitOps universe, from end-to-end CICD pipelines to creating Git workflows.

Subscribe to Red Hat's YouTube channel: https://www.youtube.com/redhat/?sub_confirmation=1

About OpenShift:
Red Hat OpenShift is an open source container application platform based on the Kubernetes container orchestrator for enterprise application development and deployment.
Openshift.com https://red.ht/33Fh6uV
OpenShift on github https://github.com/openshift/
OpenShift on redhat.com https://red.ht/2o4ccDk

#RedHat #GitOps #Kubernetes

A

A

Good morning, good afternoon, good evening, wherever you're hailing from welcome to get up's guide to the galaxy, I am chris short host of redhead live streaming. Eventually I'll say that correctly and I'm.

B

A

One and only christian, the getups guy hernandez. How are things with you christian.

C

It's it's been great yeah. I also need to pivot from saying openshift.tv to red hat streaming right, like we.

B

C

We we sold the startup now we're official. We should really.

A

B

Right, we should fully embrace.

C

It right so exactly.

A

um Officially, I have to go, google open shift tv and find every instance of it, though,.

C

Because that's how you like.

A

It spread like very quickly yeah.

C

Yeah yeah, so I I. I also need to make that mental switch, because it's a good thing right, that's a good thing! So um yeah doing great, as you all see me and um uh and chris here chris and I you have we coordinated shirts, do we actually.

A

Do it this time we did coordinated.

C

Yeah yeah, it didn't happen by accident, how it usually happens um so uh yeah, so today, um uh pax show right because uh we're kind of revisiting our back as some of you, um hopefully you've forgotten, but I'll I'll I'll remind you. uh We did a show about our back right and the demo kind of fell on its um on itself. um I.

A

Mean do you want anything or not.

C

Yeah, well I mean you know, let's embrace it right, we we.

A

Embrace failure go ahead.

C

Link link to the to the old one, so I figured we. We talked a little bit more about our back uh kind.

B

C

You know review some of that and um kind of actually, hopefully, if the demo gods are with us, go through three different demos, so it's kind of kind of packed today so.

A

C

Yeah, let's roll so before we get to it, I actually have some things to share. So, let's, let's.

A

How's, the universe.

C

Yeah how's the universe. This ask this: ask the galaxy right. Let's, let's take a look, take a quick! um Let me know when you can see my screen. Oh, let me move this little yeah yeah! You see it! Remove this little thing. I'm gonna do my best andrew sullivan right. It's like ta. uh You know topical things right, but I like the way you put it right. Let's, let's take a take a spin around the galaxy see what's going on so um a couple things I do want to mention is the.

C

um Let me put this in chat in in the stream chat, so you guys have it um so we released so by we meaning the communities released. Application sets version 0.2 so um and that'll be um alongside with argo 2.1.

C

So here this is a great great article here from uh jonathan west, who is not only a member of the argo community but is also a red hat engineer uh kind of wrote up this little quip here um about what's new in in the um in the release.

C

We've talked about application sets before right. So when this uh comes ga in um on openshift I'll revisit this- and you know talk about like what's new and upcoming, but if you, if you're like me, if you like, living on the edge the edge of the galaxy, go, go ahead, uh go ahead, read that article um and take uh application sets uh for a spin right, especially if you're using them already there's some really cool new generators and uh some bug fixes and whatnot.

C

So, oh yeah I'll, uh let you guys take a look at that. We'll promise I'll come back to this because there's a lot of cool stuff. I want to talk about.

A

um Also, this is an office hour folks, it's anything about get ops so.

C

Go ahead, yeah feel free to.

A

Ask your questions: we'll get everything queued up and we'll get you answered.

C

Yeah, we'll uh we'll help you out where we can, if we.

A

C

Figure it out we'll we'll make it up so.

A

Yeah we'll find somebody that can actually help you.

C

Yes, we're good people, we're good people um get ups con north america. uh The schedule is out so uh schedule.

A

Is out, I just dropped the link.

C

Schedule is out, you dropped the link perfect, so uh schedule is out um a lot of cool stuff going on right. I'm actually.

A

Working on speakers yeah a lot.

C

Of cool speakers, I'm working a blog kind of highlighting all everything. That's um that's coming up here, but just some of the key things is um that I want to highlight first uh dan garfield and scott rigby, who were actually on the show before um separate occasions, right uh they're going to do kind of the state of the get ops and the get-outs working group. So that's going to be kind of exciting to hear uh I have a keynote there so kind of little.

C

You know little bump for me, hey yeah, um but we do have things like end user stories. Right there's. um You know we have architects from chick-fil-a. uh Starbucks um uh cern has has a talk, so that's going to be really really interesting. That's really cool! um I'm going to be excited about that um uh people from state farm, and then you know the usual suspects right. Red hat, weave works uh code fresh! Is there um so um you know people from vmware. So it's it's a really action-packed. It's one day.

C

um We actually had enough to make multiple tracks, but since this is a co-located event- and we only had one day, we only have one room. So we.

A

C

So we have a single track, but there's there's a lot of things um that uh that's up and running so uh go ahead. Take uh check out the schedule, build out your schedule and don't forget to register right. So.

A

C

um You can register on the same page or, if you're registering for kubecon, there is a, uh you can add it as well. So remember, it's also a uh um hybrid event. So, if you can't make it in person there are, there are going to be streaming it um on the cncf platform right, whichever platform I forget which one to use so the yeah. I forget.

A

The name of it but yeah yeah, so.

C

If you can't make it out to la right, I.

A

C

No big deal I'll be there in person because I live here, but all.

A

Right, but if you can't make.

B

It the only one with a valid reason: yeah.

C

A

Convention center yeah.

C

Yeah yeah well actually yeah. Well, the drive is gonna, be it'll, be as if I'm traveling.

A

um That's true l.a.

C

L.A traffic is bad, so for those that know um so anyway, if you can't be there in person, you can be there virtually um so it'd be a hybrid event, so no worries there. So um one last thing taking talking about conferences, yeah argo, con, uh it's gonna be december. 8Th um cfp still open right, so um you know we'll be there um red hat go fish into it. You know kind of the the core maintainers of argo, um specific to argo right. So it's! This is not just argo cd, ops. This is like workflows.

C

This is image. Updater application sets like all the everything under the umbrella of the argo project, so um I'll drop. This also.

A

I got it, I already did it. Oh you.

C

Got it look at you, you're you're,.

A

C

A

C

So um yeah, so it's uh it'll probably be virtual. We talked about it, maybe being in person but it'll, most likely just be virtual um stay tuned, but it'll it's 90 be virtual, so um so yeah cool so now topic at hand, let's get to it, so um so are back right. So this is. This is a uh um uh a topic that always comes up, especially with people, especially with people. First adopting uh get ops and argo cd in their cicd workflows or in their environment right because it's like it's it's the first thing.

C

That's that's that's top of mind, um um especially for like me, on on the admin side, release management side. That's like a really really important! um So just to recap right, if you didn't watch it, I don't know. If you, oh yeah, you did put um you posted. So in the link we talked about our back kind of in depth before so I'm just going to go over really quick about how our back works in argo cd before we kind of dive into um multiple ways of doing it. So.

A

C

Make this a little bigger here, just yeah.

A

Please I was just about to ask you that.

C

Yeah make this a little bigger, so you can see. So um let me put this: uh did you put that in the chat.

A

I'm grabbing it right now, but you can do it.

C

I beat you to it first time: okay,.

A

But I'm bookmarking now.

B

Yeah you're bookmarking.

C

Yeah so that way, you're quicker next time, um so uh argo city has actually has two built-in roles. So there's two, so there's read only and full admin right. So that's kind of like the two extremes, wow.

A

Lots of options yeah.

C

You can either only you know, you're only looking through the window or you're inside causing a ruckus right, there's. No, um so there's no um and and the default is read-only by the way. So um that's.

A

C

Yeah, so the default policy is, is read-only like if you don't define it right, so um so the way our back works.

C

You know, after like the built-in one it's like well, if you need something more granular you have to like essentially built it, your build it yourself in argo city, so it actually gets so essentially it's it's it's. The idea of like legos.

B

C

Like we'll give you the lego pieces, but you have to build it yourself, and so um there are uh you're setting up your rbac scheme. Right is essentially it's a configuration file and comma separated values, and you essentially you start with, like p, meaning you're going to build a policy and then you're going to target a role, a user, a group whatever right, whatever you scope it down to so for most people, it's going to be a user or group, and then the resource right and the resources can be like us explains down. Here.

C

It could be clusters, it could be projects, it could be applications, it could be repositories right, resource, meaning like a resource within the argo city, world right right. So it's.

A

Not a kubernetes resource, no, not a community.

C

Argo city resources- things like um you, know the things that are listed down here so and then an action you can perform against that resource. So things like get create, update delete. So you think the of the the crud right.

B

C

Of just basic um things that you can do to a resource right, you can update it, you can list it, you can, you know, delete it. uh Have some things called sync right, sync, specifically to argo cd, you can sync um the resource um and that's the object, uh the the uh the action and then um the object, the object within the resource that you can perform that action on right. um So, let's that sounds if that sounds all sounds confusing. It is because it was confusing to me whenever.

A

First, when I was first diving into it right, no.

C

A

I would be kind of dumbfounded too, at first.

C

Yeah, so I'm like wait what like so then. How do I build these so tying it all together. So even the example is a little bit um I think upside down because they give you the policy.

A

To open up everything.

C

First yeah: well, they give you the policy first and then to me. It makes sense like building on top of yeah, like you're building guys, I guess, you're building on top of your roles right. But for me I like to build my role first and then assign the policy to the role, but in my mind, that's how it works. um Okay,.

A

C

This example I'll that's. This is why I'm starting at the bottom- I guess this is a long way of me saying I'm starting at the bottom, um so this g in your policy, oh by the way here, it'll, say uh default policy you can set default policy to you know specifically to read only or admin, but.

B

If you don't yeah.

A

Please don't put admin right, we'll put.

C

The default policy right.

A

Yeah, it should be deny.

C

By default, um so here what you're saying is all right: I'm going to dif a group right- and it says here your github organization, your team, so right away, you're going to be like okay, you know and I'm going to say, roll org admin. So a few questions pop up right right. So first, you know you said: there's only two built-in roles so why? Why is this? This different role now, like huh yeah.

A

Where did this.

C

Come from so where did this role come from?

C

First question right right, a second question: how does it know my github org and your team sort of um sort of thing, so yeah structure or anything like that, so um so stepping back just a little bit and then I'm gonna jump right back into the argo way of looking at things so like if, technically speaking, in kubernetes, there's no there's not really a such a thing as a user or group right, it's just it's just a label that comes along with an api call right right, so your api call just comes with a label saying user equals.

C

You know chris short or group equals admins right like, but there's no like real thing in it right um as it grows. Obviously there's you know they created objects and stuff like that. But if you just really think about the api calls that are happening back there, um that's all. It is right. So so now, jumping back to argo, cd, similar thing right, argo, cd, doesn't house users or doesn't house groups in the traditional sense.

C

It basically relies on the platform to pass that information onto it. So um so, when you say your things like your uh github org, your team, that's just the label that comes through kubernetes right so in in the openshift world. When you connect to your oauth, your oauth is going to have certain fields in it like uh like group, membership right um and that's going to come through into argo cd. So um so I but.

A

It only comes through and the labels that were given to it, or you gave it.

C

Correct, yes, yeah! It's only coming through with the labels that were given to it right. So then, so it's very important how you tie those things together um and then, when you're saying raw org admin, you're saying okay policy role, rightman for applications, it can do anything to any sub resource. I'm going to allow that um here so like down here, I'm going to create a policy so for row, org admin for the repositories, I'm gonna allow for it to delete everything in that.

C

um So you're setting up policies all right. So then you have you set up your policies in this weird weird way, right granular way, and then you set up. You know who it applies to and how do you tie those together right, and that is in uh this next thing here. So let me put that um in the project right. So then, when you're talking about projects you're talking about the argo cd project, not the openshift project, they're independent of each other um and.

B

They have their own view.

C

Of how these things go right so.

A

Right, don't project don't complain yeah, they.

C

Have the same name but they're different, so.

A

Yes, they are different things in different places.

C

So um so the biggest difference is that a argo city project can span multiple namespaces on openshift and kubernetes, so cool, whereas it's a one-to-one relationship on openshift. So that's why it's kind of hard to to think about it.

C

So um I'll I'll, let you guys read some of the boring stuff here, but the what I want you to take take away from this document here is that so here um so when you're, specifying your app projects, you're going to say, hey in my app project here- are the policies I want to target these groups right right, so you're, saying policy um for this. This role can get all the applications under projects and apply that to that group.

C

So um so this this is kind of like the high level and it's it's really really hard to like grasp all the little pieces. So um this is why I ended up just like having three demos, because I think it's just easier just to just to see it in action versus trying to piece all these together. um So uh let's go through.

C

Let's go through the three demos right, so I'm gonna go through three demos, the first one. This is using um openshift, get ops, okay and uh red hat sso, and so I have to say this first demo is the one that is a hundred percent supported. So this.

A

C

So what I'm showing you is 100 supported. This is the way we're um if you're going to do it. Do it this way and you can call red hat and red hat will help you throughout this whole process, happily help you through all this process. So I because the reason I call that out is because I'm gonna go through other ways that are not supported so so this I I decided to go on the first one um to go full support here.

C

So let's go here, I should have uh here: let's do uh oc get pods uh openshift get offs right, so I I installed the operator um already, because that's just easy right, you just click a button. You saw the operator.

A

Yeah I'd link.

C

To the docs for folks, yep and then, um and so uh what is easy here is what you want to do is um so in order to set up for sso, you have to do two things, one. um uh You need.

A

To have some place to call.

C

A

Well, let's see.

C

uh So the operator takes care of this for you, so the oc edit r go cd open shift, get ops in the open shift.

C

Get up same space, okay,.

B

All right, so here it's pretty easy. You.

C

Go down to the spec and then um you add sso, and then you do a pro. I think provider provider.

A

Provider makes sense here.

C

Yeah uh key cloak, if I spell that key cloak, that's right.

A

Yeah you built it right.

C

All right, so essentially you just add you just tell it in the specification uh key cloak and then this will kick off a deployment. So if I do get pods here as.

A

C

So that's that's adding so this is um just.

A

C

So essentially, oh and it adds all the connections for you. So, uh okay, so like it say, right yeah, so um so normally in your sso, like if you're using key cloaks. So for those of you who use key cloak, you have to go in, um create a provider and then add the open shift as the provider and then add the odic connectors and then tell argo cd to this is your os. um Oh, I open id connect oidc um bridge to you know whatever right.

C

So all that stuff the operator does all that for you. So me as a dumb admin. I like.

A

C

A

C

Oc uh roll out, oops we'll see get deploy. I think it's deployment. Let me clear this.

C

It's not a deployment, it's not. What is it yeah? It's a pod now.

A

Is it a story yeah? What was it oh yeah? It might be a stateful set. No.

C

Or it no that's, not it uh damon set.

A

Damon said we don't.

C

Know what it is.

A

How do we not know what it is.

C

That's a good question.

C

Is it a deployment config? Oh, it's a deployment. Config, look at that.

A

There you go all right.

C

Let's go uh pause, I think it should be fine. Now you get.

A

Your gold star of the day christian.

C

There you go uh yeah, it takes a while, so um so yeah. So then that is getting set up uh so, for I think, should we wait for the rollout? Should we try.

B

C

So um if you want you can roll out status uh key cloak.

C

Right so for those um there we go.

A

There we go see, I told you, but.

C

It's out all right cool.

A

So that's it yeah.

C

Let's see get routes, um open shift, get ops and then we have should be right. There.

A

C

That's it here, so, let's, uh let's go here except the self sign certificate, so here you'll get come.

A

On oh boy, here we go. Let's.

C

A

C

There we go so here, it'll it'll it'll, give you. um If, for those of you is key cloak it'll, have um this password yeah using a password there here, so um so before I click. So let me just click here right.

A

C

Happens right and then so here's a caveat so one caveat so one here. First time you do it well see. The thing is usually here: you'll do cube admin right and you're.

A

Not supposed to, but yes, I do well.

C

Well in well, most people do right when they're testing, yeah and and even some of them keep cube admin around as um like.

B

An emergency failure yeah like it's a fail-safe.

C

Sort of thing: here's a caveat: you can't use cube admin with uh um red.

B

Hat or with cake.

C

Cloak, no, no with argo. It works with largo, just not with a key cloak all right so here so that that's that's one issue, so you need to actually have a user. um So so for this I have um oauth so off yambo. So here um what I'm going to do is I'm going to just create a simple ht, password provider.

A

C

And the hd password is just going to be ocp admin open shift right like it's just I'm just going to add, add that password file so that we can use that user. um It doesn't have to be http password. Remember it could be whatever you want and open.

A

Connect to whatever github yeah yeah, whatever you want so.

C

I'm dlc apply to that. um Let me try it again. There we go so um okay, so then that that'll cause the api server to to reload. So, while we're waiting for that, let's uh give that user, which is a user ocp admin. Let's give that user uh permission uh cluster admin right, because that's what we want we'll see: adm paulus, paulus policy, uh add cholesterol to user cluster admin uh to the user, cp admin cool, wait.

A

C

There we go yeah.

A

Yeah, it's it's not found weird yeah.

C

Yeah, I always yeah, and I always do it twice too, just uh technically the first time it works, but I just do it the second time so that way it doesn't. I.

A

Hate things like come on: why throw the warning yeah.

C

uh So this I have to close it here. Let's do an oc, get pods uh open shift.

C

Api server there, it is.

C

So that should have, although or maybe.

B

Something else.

C

Well, it should have um says aged two days, so I don't think it rolled it over. It should have, I think, oh let's try it. Let's get the route again. Man.

C

All right so here again key cloak login with openshift. So now here.

A

This is where your provider, so.

C

Now you do hd password provider, so let's do ocp admin uh whatever the password was it open shift? You.

A

Had it because we're very secure here, yeah.

C

All right so here, obviously what the oauth is asking what information you need. I want the user's full information cool, um so here it brings you up this this little information here that.

A

You have to provide.

C

Who art thou right your email right so I'll put uh chris short at redhead.com.

C

Right chris short right here, um I need to provide that information, so it saves it and keep broke. So you do that uh and there you are right, you're logged in and if you take a look here where is userinfo, so here um uh has a username here and the groups here. So here's another caveat.

A

So it creates a username and a group of the same name with.

C

Of your email right.

A

C

Another here's another caveat um with using sso, so let's just create a group: let's go oc adm a group.

C

Just let me clear this, so you guys can see it oc, adm groups and I always have to get the help uh new who doesn't yeah, who doesn't need the help? uh Let's, let's, let's create.

B

C

Group groups: well, okay, what was it give me? A cool name, a fun name.

A

C

A

Oh, I should have given you one that you could spell easily.

C

Yeah exactly mississippi, yeah and add uh openshift admin to it right: okay,.

A

C

Then, if you do oc, get uh groups, groups.

A

There'll be a banana, and this is a group no.

C

And then ocp admin here, if I reload this, uh though that group doesn't come through so there's there's an issue with sso where um it doesn't pass through the group to argos. So, okay, so there's there's a sso, and so then that's why I had to enter the information first.

B

A

C

A

You didn't get it from sso.

C

Correct yeah, correct yeah, nothing came through it's just your username just came through so um so we're you know doing those fun things here. So then um also, I need to give the controller admin access one second, um okay, cool. So um next step is actually setting up the policy for this user. Slash group right and that is done um in the config.

B

Map, I believe.

C

I'm checking out my notes here. um Where is a config map ah here it is okay, so uh it is a config map. So, let's clear here's, this oc get uh cm, get ups.

C

uh Argo cd should be uh our back. There we go there. It is so that's uh edit.

C

So here cool, so then uh policy default read only right. So that's the read, only good job, um good good good stuff here um and then uh so the policy csv. So let's uh create, um let's create one, let's call a g, so the group c. What do we call? You go.

A

Back to the docs.

C

A

Have just done short that would have been easier.

C

Yeah, it would have been easy. Oh wow. Okay, do you have that email? Address short? I do short red hat. That's great! All right! I.

A

Wanted to get chris I'll take short.

C

I'll do a roll here and then admin right so remember raw. uh The admin role here is a built-in role, so I don't need to define anything else right built in so I don't define anything else. I just say for the group: whoever is part of the chris short group, christian redhead.com, give it uh the admin role and then so uh and there so then. Actually that should be it. So, let's create an app.

C

Then project default. I thought that, let's do manual, uh let's go to my uh uh get ops examples.

C

Well, what's funny is that there was like someone posting, an issue on um on uh the cncf uh argo cd, slack channel all right, and they were like having trouble like testing something, and it turns out they were just using my repo- and I was like well like this- is like my this is my.

A

Scratch personal scratch: that's like my notes.

A

Like don't read instructions from my notes, please yeah yeah, exactly.

C

Don't this is this is ugly, so I mean it's fine to get ideas and stuff.

A

Because you use.

C

A

I'm not calling your baby ugly.

C

Yeah but it's ugly, no I'm 100 there for you uh with you, so uh so bgd! So let's do that that one's always easy.

C

And then again, so then I'll create this. This should create it here. Let's synchronize synchronized swatches, yes come on.

A

Sink didn't realize how high I had to hold up my hand to show my watch there. You go.

C

Cool so now, chris short is able to do um all the fun things so admin right. So this this kind of shows that um uh you can offload authentication to something else right with red hat sso, so this doesn't necessarily have to use openshift's oauth, but I think um uh it's just easier right, because you're using openshift can connect to like github or ldap or active directory uh google. I mean all kinds of stuff right um and you can use the users coming through that way right, and this is a 100 supported.

C

uh What do I? Oh.

A

C

This is another thing, I'll show this something else, but um um so yeah. So that's the the the idea of of of using random sso. So the caveat is that groups don't come through right. So if you are, um um if you are those people that just does everything with groups and not individual users, um this may not work right. You may have to tweak your your workflow.

A

Yeah, you might have to build out your groupings a little bit. You.

C

Know in advance, yeah and then uh second one is you can't use cube admin right, so you have to actually have to use a real user right.

A

C

User on the on the platform right so um but other than that this is 100, supported right all right with get ops operator, red sso, it all works, it does it for you. As you can see, I only had to do a few tweaks here here and there, but other than that it works out just just uh just fine and you can call red hat for it. So um that's.

A

Number one right right: this is supported now we're moving into.

C

A

C

So now now this is now we're gonna talk about unsupported territories. Let's go to the next classroom here um cluster I have here. I have to have I built three clusters, so just to kind of keep, keep it separate.

A

Your cloud privileges are showing.

C

My color, oh yeah, exactly you're, 100 100 right on that right, so I didn't install the I did not install the operator here, um for a very specific reason is because um the unsupported way starts all the way from install right so on install. I actually need to tell it um that I'm running unsupported. So let me take out my notes here, so you can kind of see so here by the way. This is how you install uh an operator from the cli right.

C

You just provided a subscription and it just magic happens in the background. um But then here I have to add this configuration right, so configuration environment, disable dex equals false, meaning. I actually.

A

C

I want to be able to use dex, um and so are the pods up and running. Get pods open shift get ups not yet.

B

C

Have a little handy, dandy.

C

Script here all right, so we'll start waiting on that, so um so by default, the um the get ups operator disables dex, um because it's not officially supported by red hat. So again, this this method here is not supported by red hat, um but it works it's one of those things, um it's kind of hard to to explain to people being an open source company right um because, like usually when a company, um this is especially true like with like oracle or microsoft like when they say something's not supported it's it's it.

C

It means two things, meaning that one we won't support. You and two it doesn't even work right right, um whereas like in the open source world, is like well, it's not supported in that you can't call us, but it actually technically works and works. Fine. So- um and this is one of those situations right, although it technically works and I'm showing you how to do it, it's not technically supported. You can't call it red hat for it. So no I'll.

A

Just draw a word chat.

B

C

Case you were curious. Please read it it's your query, that's right! So I'll, just indemnify myself! This essentially is what I'm doing so.

A

Some stuff's coming up now cool.

C

Stuff's coming up cool so here um similar to the sso, is actually you just kind of modify the operator and the operator does everything for you? Okay, um so I have actually a specific patch I'll, just run the patch and then I'll we'll take a look at it after right, because that's when I cut what you're doing there, it's quite the sad.

A

Yeah yeah, it's.

B

An army patch right.

C

Well, I'm on about uh automation, so.

A

Well, I get it, I get it you're copying.

C

A

C

It's it's hard to read right.

A

C

Do, um let's export uh our go cd, openshift.getops.

C

And then let's write that to temp uh oh yeah, yeah and then uh code.

A

Oh, look at you.

A

Hopefully you're sharing your whole screen.

B

C

Wow, so uh this is that.

A

Yeah no whoa put that thing away, but just hit the search thing again.

C

Yeah, um so so yeah, so here we go by the way for those that you saw. I saw I ran an oc export, that's not not an actual command. That's a it's a plug-in! I have.

A

C

You're curious, uh there's a plug-in here so in case.

A

C

A

C

Yeah, let's, uh let's minimize this anyways- that we don't need that here we go here's the section I want um hold on: where is it there? We go?

C

uh I think it's missing something hold on. Maybe my my export didn't work. Oh.

A

C

So there's dex right.

A

C

Hear I say: uh dex openshift oauth equals true. So essentially I'm saying hey uh dex. I want you to um set yourself up for openshift olaf, so it's already built into the decks image even upstream right, so it's already built in so you can use this with uh okd or openshift.

C

um So that's just step one you're just enabling decks all right step. Two is kind of like what the where the gnarly configuration is. um So here we go so.

B

Here I'm setting up our back.

C

All right so here lane line 63, you see um default policy I set to blank and when you don't specify default policy, the default policy is read only and then um then I'm saying anyone who's cluster admin.

C

I want you to assign the role admin, so anyone who's part of group admins is part of the role admin. So that's makes sense. That's the built-in role um the group developer, so anyone who's part of the developer group on openshift um will have the role developer and same thing for the marketing group. Anyone who's defined as a marketing group on openshift will be defined role marketing. So here's where it gets kind of weird you're like okay. Well, there's a built-in role admin, but there's no built-in role developer.

C

So where are you defining that um and that is actually in the deployment of the? uh Where is it here? Cluster configuration? Let me make this a little bigger.

C

So when I'm creating a an application project, I'm going to create an argo city project called price list, and then here I'm going to set up the developer roles right. The policy says: okay here, anyone who's, I'm defining a policy called developer and they can get um everything under this application under this all applications under this project and then I'm setting get you can sync all application under this project and I can get. I have like basically view of everything under this project.

C

So um that's where I'm setting these policies- and um so this so essentially you can think of this. This column here is the group as it comes in to um openshift and then the role marketing is how I'm defining that role inside of argo city, and that's like where the connection happens and again, I'm gonna scope out the groups, so that is um and then the other copy pasta stuff is it's just resource customization specific for this application.

C

We don't have to go through all this, maybe I'll uh I'll do a stream about resource customizations and what you can do for aggressive. That's actually a good idea. Maybe I'll do that.

A

Yeah yeah that.

C

Is a good idea, it's like how do you customize how argo cd uh checks the health status of things right, so, especially if you have, if you're, if you're, creating like crds and stuff yourself, you want to control how argo city man um handles those. So um I just saw in chat that you have the referee.

A

C

That's great, um I love that, so let me let's, let's exit out of here um so cool, so that should be so while that's going, um let's see get pods uh open shift, get ups.

C

And then uh come on decks there. It is so dex servers there. So now that that's there, let's apply this actual application project sort of thing. So where is talking about another coffee, pasta here.

A

Copy pasta, coffee.

C

That's right: well, I forgot to do this. I had to give it give the controller admin, so I can actually do stuff.

C

Come on there we go this now, we'll just deploy this repo all right. This is the repo that has all the stuff I want to configure.

C

So this will take cool blue. I probably should have ran that and then explained it because now.

B

C

Now we just sit around for it to to to apply.

B

C

A

C

um Also, I have, I have other well, that's in the other one one. Second, oh wait. No it's which one am. I am. I deploying good question okay, so this is. This is.

A

You're on cluster two yeah.

C

Yeah, I'm unclustered. That means.

A

You're to blame, dex and.

C

Let's close that guy, uh I don't need that config here.

A

I appreciate the tab cleanup though right.

B

C

B

Fully appreciate that.

A

You gotta get rid of that stuff, or else you get confused.

C

Oh man, you get you get into well, then then, you end up like um like you and I you end up with a tab manager which is supposed to make your life easier, but it just compounds the problem. Now I have tabs of multiple tabs so.

C

So it's um it's an enabler more than anything else. Okay! So let's go to. uh Let's go to the routes, I'll get routes. uh Open shift, get offs cool. So then uh this guy here so much like the advanced except search, go baby go baby. So then, now you have this login via openshift um cool, and so let's see if the users have been added. So let's go oc, get uh groups yeah so that I have an admin.

B

C

Developer group and marketing group right so because we know market uh people from marketing they love.

A

Always need to log in. Did you give them admin just go.

C

To cube admin yeah exactly um so remember, like this group, admins was defined in the uh let's go back to code.

A

C

Shout out to the marketing.

A

Team using hardware.

C

That's right: uh the admins are are connected to role admin developer, to role developer, marketing, to role marketing. You.

A

Know I'm not easy.

C

um So that's you know, that's that group and that's the user. So uh so, let's log in with ocp admin. Okay, oh see it's not there! Yet.

A

C

Not let's go to oc, get uh pods open shift api server.

C

Maybe it's the the operator, maybe that's. Three three restarts okay.

A

Okay, all right that sounds.

C

About right, that sounds all right: yeah, sometimes it just takes a while for it to come up.

C

See now I think now it's coming up all right. Now it's coming up yeah when it cracks it's funny when it cracks out. I know it's working.

C

It's a work in progress.

A

C

A work in progress, yeah.

A

C

Sometimes people ask uh ask me like how did you figure you know like troubleshooting is like how did you figure that out, I'm like quite honestly, a lot of it is tribal knowledge. I mess up things so much that I'm like hey, that error looks familiar. I ran into that exactly.

A

C

It's like, like I t like whether you're a developer, any anyone in it. um It's not that you get smarter, it's just you mess up things so many times that you start seeing certain patterns um so.

B

C

Let's go to hd password and then I think.

C

Right so let's go full access right here me as an admin. I have access to everything, so I have um so with dex. So let's go back over here so with dex, my username comes through and you notice right here says admins. My groups come, my groups come through as well. So if I want to do um ocp.

C

C

New b-a-n-a-n-a.

C

Ocp admin um I created banana and then uh I think I have to log out log back in.

A

C

That should come through now.

C

I actually never tested this. So, let's see, let's see if it comes through, I may have to restart the controller. No bananas there, yeah there's.

A

B

C

So, if you're, using, um if you're using decks uh the groups come through so now you can start um uh assigning roles based on groups now, not just usernames. um So here as an ocp admin, I'm able to uh you know sync things right like I can sync this. If I want to you know that'll work, um you know I can see different projects right. There's, cluster config, there's price list. I can see that project as well.

C

um Let's log out and log in as uh developer.

C

uh It's a different password, I think yes, it is.

C

So here uh again developer right, he's not a banana, so right.

A

He's developed.

C

This particular developer is not a banana, that's only the admin, um but they have access only to if I go to projects only to the priceless project, I don't have access to any other project interests.

A

So so, as you see, I.

C

Only have access to this one argo cd project. um If we go back to, let's go back, where is no that's the cluster config is the one.

C

uh Config, because this is the danger of uh closing your tabs, you have to.

B

C

That you wanted to show there. We go priceless project right, so here I'm only I'm allowed to get every application right. I'm allowed to sync up every application, okay, but that does that mean. So I can sync here.

A

C

That syncs just fine it allows me to do that. Does that mean I can delete.

A

No, you shouldn't be able to.

C

You shouldn't be able to just test this right, so I get it. I can't I can't I can. um I can't delete this application, so I can I can view it right. I can interact with it. I can sync it um can I pause syncing I can terminate. Let's try it. Oh yeah it does so it allows me to terminate um the sync. So you can stop a bad roll out.

A

Anybody do something, oh that was me sorry yeah. That was.

C

A

B

Banana there's a banana group.

C

Just for fun uh the banana group, I love the banana I'm gonna start using that now. uh Ocp marketing.

A

Okay, we're good marketing, see.

C

Look at marketing see, let's see here, they can see nothing right because they're marketing, who really wants where they wants them to wait. Let's.

A

See if they can have their own little app, no there's got to be some argo thing. We can do that helps marketing sometimes.

C

Oh yes, the marketing, that's right! It's always fun. If any of you out, there have an app that can help marketing we'll throw it up on here.

A

C

Yeah marketing right marketing has that.

B

C

um So this here, the our back here on our go cd. You have to think about how it's independent of the openshift one right.

A

C

You could, you can actually have and.

A

Because it's independent, it's not supported.

C

Yeah correct so um so this this is part two right, so this is so this method using dex.

A

B

C

Yeah yeah so, which is actually a good wrap up, because by the the last way of doing it is my favorite way. It's the easiest.

B

C

So here um with dex you're able to get the you got the username, you get the groups right, so the groups come through um and you're able to use openshift oauth, which openshift oauth can use. Then ldap act directory whatever. So the only caveat is it's not supported by red hat. So um uh so there's that right, so you can. You can use dex but kind of like use it as as in your own. um Yeah honestly use it as in your own in your own demise, but it's not like dex doesn't work.

A

No right like use it at your own discretion right, like yeah,.

C

I guess your discretion yeah, like.

A

Yeah, I mean it if you don't.

C

Want any cloak.

A

You can use decks, that's fine.

C

You can use decks right and, like.

A

C

Lot of a lot of red hatters, they like using decks.

B

C

As you're about to say it's just not like you can't like, if something's wrong, with decks, you're going to have to just go on the forums or.

A

Get an issue get up the slacks or whatever get up slack and get a big.

C

Issue and just go that route, um so uh there's that so cool.

A

All right, what's.

C

Your favorite easy way my favorite way yeah, so this so so far we're talking about um argo, specific right, my favorite way is actually using git ups workflows, specifically what what I mean by that. So I have cluster three all right: three clusters: woohoo openshift getups. uh I installed the operator operators installed cool oc, uh oops oc, get secrets.

C

Open shift get ops.

A

C

Times a day do.

A

You type open shift, get ups.

C

A lot I should have a shorthand right like like, oh so right or.

B

Yeah, it should be oc.

C

Oc dash and openshift get ups and then just yeah.

A

I think I'm gonna.

C

Let's, let's do that here, giving.

A

You a new idea now here we go.

C

uh If you guys want to know how to write a function in line.

C

I think I'm missing something.

A

Yeah, I know yes.

C

I am no this thing. Oh.

A

Yeah that thing yeah, you got a terminal.

C

So oh, go get secrets uh oops, oh yeah! Does that will work no.

A

Don't don't troubleshoot this just don't troubleshoot this just keep going. I should get out.

C

Oh, I did not now I'm gonna go down rabbit, hole.

A

Anyway, don't go down a rabbit, no rabbit hole. That's right!.

C

No rabbit holes all right, so I get that secret. uh I do um not the argo city secret, uh github's cluster, where.

B

C

It's one of these.

A

It's one of the server tokens, maybe.

C

uh Oh here I actually have it. I could copy pasta all right. Oh uh openshift, cluster, that's what it is.

A

Got it okay, so you were going down the right path. There.

C

Get routes open shift uh get ups. I know I know the mistake I made and I I'm I'm trying to.

A

Not go back to it. Yeah I got to resist.

C

Going to it, because I need to make a point here right so.

B

C

Oops, that's not it.

C

So here I log in as um as uh actually argo city admin. Oh so why am I doing that? Yeah.

A

Why are you doing that? Are you setting up something in argo for us.

C

um And then I need to give the controller cluster admin.

C

B

A

B

A

I just why isn't the controller getting cluster admin by default.

C

A

Is it like a day two for argo steps.

C

Yeah, so it's so we um from we, as in like engineering, red hat, is okay.

A

C

We want um the idea is that um it should be secure by default. So, okay, right, even me, giving it cluster admin isn't, is technically a no-no, although I have the belief is like if you're doing get ops, the controller needs to have full access to your cluster. um So that's just.

B

C

But argo, cd or openshift get ups. The idea is you're using it for your ci cd workflows, um and so that's why they they shut it down, meaning, like you, should probably just open it up per namespace. It makes.

B

C

Right so like from from that aspect, it makes sense. So here um let's create a new app.

C

I don't care which project.

C

Yolo, ops yeah exactly uh let's create here right, so I logged in as um wait. Am I missing something? Oh project.

A

Oh you do have, I guess I do have to specify. I can't tell it no project.

C

I can't tell it yellow right.

A

B

A

C

And then I sync, so um the point I'm trying to make here is that now, if I want someone to make changes here or if I want someone to do something with a cluster, I actually don't want them to log into argo cd. So, okay.

A

C

Get up standpoint, what you need to do is someone needs to make a pull request right right, like.

A

C

I'm moving the the um the.

A

Back yeah, the.

C

Change yeah the point of change into your git workflows right now, so using things something like github, bitbucket, um gitlab, um whatever right now, there's.

A

A bunch of them yeah they have their own yeah.

C

Yes, yeah exactly um I'm surprised, google doesn't have one, but.

A

C

um I think they do. I know I know, azure has one it's really weird anyways everyone has their own get t I like using get t.

A

C

Yeah yeah getty's awesome. The the idea is that you're using that system right, the.

B

C

Built in to uh your git workflows,.

A

Yeah, and so that way it's one management of users and groups and so forth so on, and that management of it is done in the system of record correct, which is yes hub or git lab or whatever it is. You might.

C

Whatever it is in the source of truth right in your.

A

C

Sources like you want to keep track of all those changes in that, so um so.

A

Really you're just using argo admin and you're done.

C

Correct and um okay, and so there's a few things with that, so uh one one it's 100, supported by red hat. That's.

B

A

Important good point: yeah.

C

And two: it's actually um this workflow doing just you know, making pull requests using that whole system is tool agnostic, so it works whether I'm using argo cd. It works whether I'm using acm. It works, whether I'm using flux. It doesn't matter what tool I'm using.

C

A

Is my git workflows? Yes right, you put, you solve the problem in the git repo.

C

A

You saw so like if you're in the github organization or get organization of any type yeah.

C

If, if you don't want marketing to make changes, you don't accept their pr's.

A

Right right or you don't even know you.

B

Don't even let them in your organization right like.

C

A

C

Get in your github organization, you don't even let them in right. I.

A

Mean unless they need to make a change to a certain file that would then kick off another sink yeah.

C

A

Mean you keep their.

C

I mean that's, that's the granularity right. That's.

A

Right, like that's the okay, you get access to this one project right or one.

C

Project repo yeah, so I am a fan of letting the tool do its thing right, not.

A

C

B

C

You know into the tool itself right, even though it's it's more than capable, and even though um gerald right, who I talk about a lot disagrees with me. I I, which is cool I mean I, I.

A

C

A

Understand I understand both sides right, like.

C

A

Neutral party here I understand why you would be like nope admin means cluster admin and cluster admin means this group done. They have access to that and then developers get to it through github or get lab.

C

Or get whatever.

A

um I understand that model, but I also understand the potential need for a developer to stop a bad sync.

C

Yes, or without working pick up the phone right right, yeah, just like view like how did my sync go or what's the status of so I understand I I I also understand both sides right, I'm not saying one's um one's better than the other. What I'm saying is that um they're, both they're both possible and whether you want to do one or the other. You can right, they get yes, you can do it right. So so.

A

We got a question and we have 70 seconds. Let's do it. It.

C

A

Same as simple cicd right, like trigger a build with a specific commit name, specific branch on full.

C

A

Totally, that's what github.

C

Is about yes, correct.

B

C

So I so yeah, so I've been using like maine right and like, and you know going to the head of maine.

A

Right like if it goes in maine.

C

Yeah but like you, don't you don't have to right, like you can do.

A

C

A

Yeah, you could say if you merge things into this branch of repo.

C

It goes off yeah, you could cut yeah and you could.

A

Even say not only.

C

Target a a branch but a specific, a tag.

A

Yeah yeah yeah, yeah yeah, that's awesome! So.

C

Yes, such granularity.

A

Such power such power.

C

B

A

Give people access or not give them access to it just depends.

C

On you want to manage change.

A

In your environment, yeah.

C

Exactly so, just imagine just imagine where you want to manage change and there's something there for you. um I went through three right.

A

Two of them are fully supported.

C

There's more right, two.

A

C

Are fully supported, uh one of them is not supported, but totally possible and it works. It's just. You know, buyer. Beware right! We we can't support decks right now, so yeah um so yeah. We did this in an hour. Look at that.

A

Good job christian, I thought I was gonna go over.

C

And I thought we're gonna have trouble, but it looks like.

A

No dude, you nailed it man, great work, yeah, so.

C

A

Augustus says nice awesome awesome. Thank you. Thank.

C

You welcome, by the way, welcome.

A

Yeah welcome. We appreciate you tuning in live if you're watching this after we appreciate you tuning in as well.

C

Noreen said he couldn't make it one of our regular watchers.

A

Yeah narendra could not make it because he has the.

C

Flu he has a flu, but if you're watching this on recording I'm just saying hi. Thank you for watching.

A

Thank you very much, all right christian I'll catch up with you later. I have another meeting to run off to.

C

Yes, yes, thank you. Everyone.

A

Thank you and stay safe out there.

C

C