Add reference implementation example #138

nabuskey · 2024-01-26T19:08:37Z

Adds an example for the cnoe ref implementation. Related to #142

Signed-off-by: Manabu Mccloskey <[email protected]>

Signed-off-by: Manabu McCloskey <[email protected]>

cmoulliard · 2024-02-08T12:30:06Z

Question: As the goal of this project = idpbuilder is to help the developers when they create/design an IDP platform, will the backstage app installed with the example include the needed "plugins" able to show the following views: argocd, keycloak, etc ?

cmoulliard · 2024-02-08T12:30:41Z

Can you please link the issue #142 to this PR's description ?

cmoulliard · 2024-02-08T12:37:28Z

examples/ref-implementation/README.md

+
+This example creates a local version of the CNOE reference implementation.
+
+## Installation


Can you also add a prerequisite section as I suspect that we need:

kubectl installed + kube OIDC login plugin (?),

idpbuilder version 0.x (the x should be defined ;-))

An account on Amazon and S3 bucket,

also do we need something to put in there with regards to system specs? or at least memory requirements. my 16G core i7 cant handle it well.

cmoulliard · 2024-02-08T12:42:45Z

Can we please add also cert manager ?

nabuskey · 2024-02-08T17:12:30Z

Question: As the goal of this project = idpbuilder is to help the developers when they create/design an IDP platform, will the backstage app installed with the example include the needed "plugins" able to show the following views: argocd, keycloak, etc ?

Yeah plugins are baked in with the image. Source is available here: https://github.com/cnoe-io/backstage-app

Can you please link the issue #142 to this PR's description ?

I mentioned it in the description but this issue is a bit different so I won't close the issue.

Can we please add also cert manager?

I left it out because it's heavy as-is, in terms of resource utilization.

Signed-off-by: Manabu McCloskey <[email protected]>

nimakaviani

looks great. some minor comments from me

examples/ref-implementation/README.md

nimakaviani · 2024-02-09T19:34:46Z

examples/ref-implementation/README.md

+
+This example creates a local version of the CNOE reference implementation.
+
+## Installation


also do we need something to put in there with regards to system specs? or at least memory requirements. my 16G core i7 cant handle it well.

nimakaviani · 2024-02-09T19:35:35Z

examples/ref-implementation/README.md

+3. **Crossplane**, AWS providers, and basic compositions for deploying cloud related resources (needs your credentials for this to work)
+4. **External Secrets** to generate secrets and coordinate secrets between applications.
+5. **Keycloak** as the identity provider for applications.
+6. **Spark Operator** to demonstrate an example Spark workload through Backstage.


if someone doesnt want Spark for example, is it as easy as removing the manifests for it? or is there extra configuration in other components that they need to tweak?

also do we need something to put in there with regards to system specs? or at least memory requirements. my 16G core i7 cant handle it well.

That's actually concerning. On my Ubuntu machine it consumes about 5GB memory. How much resources are you allocating to Docker Desktop VM?

if someone doesnt want Spark for example, is it as easy as removing the manifests for it? or is there extra configuration in other components that they need to tweak?

yea just need to remove the argocd app spec

Why do you use Apache Spark as example ? AFAIK, there is no backstage plugin, so what could be the added value to propose it as example ?
Remark: Should we instead propose as example a microservice such as Spring Boot, Quarkus, Nodejs or combination ?

examples/ref-implementation/README.md

nimakaviani · 2024-02-09T19:45:17Z

examples/ref-implementation/README.md

+
+![img.png](images/demo2-entity.png)
+
+Deployment processes are the same as the first example. Instead of deploying a pod, we deployed a workflow to create a Spark job.


can we link to the location in the git repo where this workflow can be found

examples/ref-implementation/README.md

nimakaviani · 2024-02-09T20:05:04Z

...tion/backstage-templates/entities/app-with-bucket/skeleton/kustomize/prod/kustomization.yaml

@@ -0,0 +1,35 @@
+{%- if values.awsResources %}


what do you think about splitting the example applications into a separate folder, so we have one folder for a vanilla reference implementation, and another to deploy the example apps. doing something like the following in the readme:

idpbuilder create --package-dir examples/ref-implementation --package-dir examples/sample-apps

I would rather just have one command to deploy everything.

I think that we should dissociate the process to install the reference implementation (= components A + B + C etc) from the step to install an example top of the reference platform. Why ? As the goal of the tool is to provision a cluster, than such implementation should be used for different purposes, to allow the users to deploy also their own examples, or examples defined in a lab project, etc

yeah +1 on what Charles said above.

nimakaviani · 2024-02-09T20:13:52Z

examples/ref-implementation/keycloak/manifests/keycloak-config.yaml

+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT --data @/tmp/user-password-to-be-applied.json \
+                http://keycloak.keycloak.svc.cluster.local:8080/admin/realms/cnoe/users/${USER1ID}/reset-password
+
+              curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X PUT --data @/tmp/user-password-to-be-applied.json \
+                http://keycloak.keycloak.svc.cluster.local:8080/admin/realms/cnoe/users/${USER2ID}/reset-password


I think we should have a note in the README that both user1 and user2 get the same password and how maybe that can be tweaked

updated documentation

Signed-off-by: Manabu McCloskey <[email protected]>

cmoulliard · 2024-02-13T07:19:17Z

examples/ref-implementation/README.md

+3. **Crossplane**, AWS providers, and basic compositions for deploying cloud related resources (needs your credentials for this to work)
+4. **External Secrets** to generate secrets and coordinate secrets between applications.
+5. **Keycloak** as the identity provider for applications.
+6. **Spark Operator** to demonstrate an example Spark workload through Backstage.


Why do you use Apache Spark as example ? AFAIK, there is no backstage plugin, so what could be the added value to propose it as example ?
Remark: Should we instead propose as example a microservice such as Spring Boot, Quarkus, Nodejs or combination ?

cmoulliard · 2024-02-13T07:23:17Z

...tion/backstage-templates/entities/app-with-bucket/skeleton/kustomize/prod/kustomization.yaml

@@ -0,0 +1,35 @@
+{%- if values.awsResources %}


I think that we should dissociate the process to install the reference implementation (= components A + B + C etc) from the step to install an example top of the reference platform. Why ? As the goal of the tool is to provision a cluster, than such implementation should be used for different purposes, to allow the users to deploy also their own examples, or examples defined in a lab project, etc

cmoulliard · 2024-02-13T07:41:54Z

examples/ref-implementation/keycloak/manifests/keycloak-config.yaml

+              BACKSTAGE_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
+                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+                -X GET http://keycloak.keycloak.svc.cluster.local:8080/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
+
+              ARGOCD_PASSWORD=$(./kubectl -n argocd get secret argocd-initial-admin-secret -o go-template='{{.data.password | base64decode }}')
+
+              ARGOCD_SESSION_TOKEN=$(curl -k -sS https://argocd-server.argocd.svc.cluster.local:443/api/v1/session -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token)
+
+              echo \
+              "apiVersion: v1
+              kind: Secret
+              metadata:
+                name: keycloak-clients
+                namespace: keycloak
+              type: Opaque
+              stringData:
+                ARGO_WORKFLOWS_CLIENT_SECRET: ${ARGO_WORKFLOWS_CLIENT_SECRET}
+                ARGO_WORKFLOWS_CLIENT_ID: argo-workflows
+                ARGOCD_SESSION_TOKEN: ${ARGOCD_SESSION_TOKEN}
+                BACKSTAGE_CLIENT_SECRET: ${BACKSTAGE_CLIENT_SECRET}
+                BACKSTAGE_CLIENT_ID: backstage
+              " > /tmp/secret.yaml
+
+              ./kubectl apply -f /tmp/secret.yaml
+


Why is the backstage secret created here within keycloak stuffs ? Such a step should be included within the backstage folder and documented to let the users to figure out how they could expand/override their app-config.yaml ;-)

Why do you use Apache Spark as example ? AFAIK, there is no backstage plugin, so what could be the added value to propose it as example ?
Remark: Should we instead propose as example a microservice such as Spring Boot, Quarkus, Nodejs or combination ?

We do have a pugin for the Spark operator. This was included in the original reference implementation and thus it's included here. The purpose of it is to show that IDP does not necessary be for applications only.

I think that we should dissociate the process to install the reference implementation (= components A + B + C etc) from the step to install an example top of the reference platform. Why ? As the goal of the tool is to provision a cluster, than such implementation should be used for different purposes, to allow the users to deploy also their own examples, or examples defined in a lab project, etc

I think we need a guide to show this part, but not in this PR. The primary goal of this PR is to showcase what you can build with idpbuilder, even complicated stuff like this. If we want to create a guide for developing Backstage stuff, it should be separate.

Why is the backstage secret created here within keycloak stuffs ? Such a step should be included within the backstage folder and documented to let the users to figure out how they could expand/override their app-config.yaml ;-)

These are for SSO configuration stuff. Keycloak client secrets are generated by Keycloak upon creation of a client. We need a way to export this to client applications (backstage and argo workflows). We could include this in Backstage stuff but it becomes a bit of a mess because we now need to do the same for other apps like argocd and argo workflows.

cmoulliard · 2024-02-13T07:57:12Z

As many of the backstage examples rely on scaffolding a project (spring boot, nodejs, quarkus, etc) on github, how will it be possible for a user to provide its GitHub Personal Access Token which is needed to configure such app-config.yaml field ?

integrations:
  github:
    - host: github.com
      token: <MY_GITHUB_PAT>

nabuskey · 2024-02-13T18:45:04Z

As many of the backstage examples rely on scaffolding a project (spring boot, nodejs, quarkus, etc) on github, how will it be possible for a user to provide its GitHub Personal Access Token which is needed to configure such app-config.yaml field ?

GitHub integration stuff is left out intentionally. It's hard to automate and I did not want to make users worry about external stuff. I wanted everything to stay local. If they want integrations with external stuff like GitHub and AWS, they can look at the Terraform version.

What I wanted to enable for this was to show how you can bring up a solution with just one command.

csantanapr · 2024-02-15T05:02:34Z

@nabuskey
tried this example, and hit a problem with argo workflows that server crashed.
I think this happens because keycloak took a while to come up, backstage had issues also but was eventually came up, argo workflows server doesn't work even with multiple restarts

k logs -n argo argo-server-6d8dbf6b99-2jdqh

time="2024-02-15T04:54:15.010Z" level=info msg="not enabling pprof debug endpoints"
time="2024-02-15T04:54:15.011Z" level=info authModes="[client sso]" baseHRef=/ managedNamespace= namespace=argo secure=false ssoNamespace=argo
time="2024-02-15T04:54:15.011Z" level=warning msg="You are running in insecure mode. Learn how to enable transport layer security: https://argo-workflows.readthedocs.io/en/release-3.5/tls/"
Error: 502 Bad Gateway: <html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx</center>
</body>
</html>

Usage:
  argo server [flags]

Examples:

csantanapr · 2024-02-15T05:05:45Z

deleting the argo-server pod, made it work with the new pod

Signed-off-by: Manabu McCloskey <[email protected]>

csantanapr · 2024-02-15T20:44:04Z

problems with keycloak got fix by the latest update to the image to 22.0.3 🙌

csantanapr · 2024-02-15T20:45:32Z

@nabuskey
hitting a problem in Argo Sync with Backstage stays in an endless sync
The Kubernetes API could not find backstage.io/Location for requested resource backstage/basic-example-templates. Make sure the "Location" CRD is installed on the destination cluster.
Getting error

csantanapr · 2024-02-15T20:50:37Z

nope, it looks like using keycloak 22.0.3 still has problems, container in crashloopback, logs:

Updating the configuration and installing your custom providers, if any. Please wait.
/opt/keycloak/bin/kc.sh: line 132:    19 Killed                  'java' -Dkc.config.build-and-exit=true -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Dfile.encoding=UTF-8 -Dsun.stdout.encoding=UTF-8 -Dsun.err.encoding=UTF-8 -Dstdout.encoding=UTF-8 -Dstderr.encoding=UTF-8 -XX:+ExitOnOutOfMemoryError -Djava.security.egd=file:/dev/urandom -XX:+UseParallelGC -XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90 --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.security=ALL-UNNAMED -Dkc.home.dir='/opt/keycloak/bin/..' -Djboss.server.config.dir='/opt/keycloak/bin/../conf' -Djava.util.logging.manager=org.jboss.logmanager.LogManager -Dquarkus-log-max-startup-records=10000 -cp '/opt/keycloak/bin/../lib/quarkus-run.jar' io.quarkus.bootstrap.runner.QuarkusEntryPoint --profile=dev start-dev

csantanapr · 2024-02-15T23:27:37Z

examples/ref-implementation/README.md

+![img.png](images/backstage-templates.png)
+
+
+In the next screen, type `demo` for the name field, then click create. 


Suggested change

In the next screen, type `demo` for the name field, then click create.

In the next screen, type `demo` for the name field, then click Review, then Create.

Signed-off-by: Manabu McCloskey <[email protected]>

nabuskey marked this pull request as draft January 26, 2024 19:08

nimakaviani mentioned this pull request Feb 6, 2024

An Example for Reference implementation lite #142

Open

add ref implementation example

7c314f1

Signed-off-by: Manabu Mccloskey <[email protected]>

nabuskey force-pushed the example/ref-impl branch from 1e27fa9 to 7c314f1 Compare February 7, 2024 16:27

nabuskey changed the title ~~WIP: reference implementation~~ Add reference implementation example Feb 7, 2024

nabuskey marked this pull request as ready for review February 7, 2024 16:28

nabuskey added 2 commits February 7, 2024 17:34

add basic backstage templates

6b77269

Signed-off-by: Manabu McCloskey <[email protected]>

ensure controller-gen looks at ./api only

cf4be73

Signed-off-by: Manabu McCloskey <[email protected]>

cmoulliard reviewed Feb 8, 2024

View reviewed changes

add prerequisites

bfe0585

Signed-off-by: Manabu McCloskey <[email protected]>

nabuskey force-pushed the example/ref-impl branch from f3cf639 to bfe0585 Compare February 8, 2024 18:06

nimakaviani requested review from cmoulliard and nimakaviani and removed request for cmoulliard February 9, 2024 19:09

nimakaviani approved these changes Feb 9, 2024

View reviewed changes

update readme

821978c

Signed-off-by: Manabu McCloskey <[email protected]>

cmoulliard reviewed Feb 13, 2024

View reviewed changes

update keycloak to 22.0.3

b6e47af

Signed-off-by: Manabu McCloskey <[email protected]>

csantanapr reviewed Feb 15, 2024

View reviewed changes

remove app name collision

2783cda

Signed-off-by: Manabu McCloskey <[email protected]>

nabuskey force-pushed the example/ref-impl branch from 27b05e2 to 2783cda Compare February 15, 2024 23:37

update readme

40ae05f

Signed-off-by: Manabu McCloskey <[email protected]>

nabuskey merged commit 6b704e6 into cnoe-io:main Feb 19, 2024
2 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add reference implementation example #138

Add reference implementation example #138

nabuskey commented Jan 26, 2024 •

edited

Loading

cmoulliard commented Feb 8, 2024

cmoulliard commented Feb 8, 2024

cmoulliard Feb 8, 2024

nimakaviani Feb 9, 2024

cmoulliard commented Feb 8, 2024

nabuskey commented Feb 8, 2024

nimakaviani left a comment

nimakaviani Feb 9, 2024

nimakaviani Feb 9, 2024

nabuskey Feb 12, 2024

cmoulliard Feb 13, 2024

nimakaviani Feb 9, 2024

nimakaviani Feb 9, 2024

nabuskey Feb 12, 2024

cmoulliard Feb 13, 2024

nimakaviani Feb 19, 2024

nimakaviani Feb 9, 2024

nabuskey Feb 12, 2024

cmoulliard Feb 13, 2024

cmoulliard Feb 13, 2024

cmoulliard Feb 13, 2024

nabuskey Feb 13, 2024

cmoulliard commented Feb 13, 2024

nabuskey commented Feb 13, 2024 •

edited

Loading

csantanapr commented Feb 15, 2024

csantanapr commented Feb 15, 2024

csantanapr commented Feb 15, 2024

csantanapr commented Feb 15, 2024

csantanapr commented Feb 15, 2024

csantanapr Feb 15, 2024


		This example creates a local version of the CNOE reference implementation.

		## Installation


		![img.png](images/demo2-entity.png)

		Deployment processes are the same as the first example. Instead of deploying a pod, we deployed a workflow to create a Spark job.

		![img.png](images/backstage-templates.png)


		In the next screen, type `demo` for the name field, then click create.

Add reference implementation example #138

Add reference implementation example #138

Conversation

nabuskey commented Jan 26, 2024 • edited Loading

cmoulliard commented Feb 8, 2024

cmoulliard commented Feb 8, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cmoulliard commented Feb 8, 2024

nabuskey commented Feb 8, 2024

nimakaviani left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cmoulliard commented Feb 13, 2024

nabuskey commented Feb 13, 2024 • edited Loading

csantanapr commented Feb 15, 2024

csantanapr commented Feb 15, 2024

csantanapr commented Feb 15, 2024

csantanapr commented Feb 15, 2024

csantanapr commented Feb 15, 2024

Choose a reason for hiding this comment

nabuskey commented Jan 26, 2024 •

edited

Loading

nabuskey commented Feb 13, 2024 •

edited

Loading