Overview
ConfigInit is a special container used to load (generate/restore) and dump (backup) the configuration and secrets.
Versions
See Releases for stable versions.
For bleeding-edge/unstable version, use gluufederation/config-init:4.5.1_dev
.
Environment Variables
The following environment variables are supported by the container:
GLUU_CONFIG_ADAPTER
: The config backend adapter, can beconsul
(default) orkubernetes
.GLUU_CONFIG_CONSUL_HOST
: hostname or IP of Consul (default tolocalhost
).GLUU_CONFIG_CONSUL_PORT
: port of Consul (default to8500
).GLUU_CONFIG_CONSUL_CONSISTENCY
: Consul consistency mode (choose one ofdefault
,consistent
, orstale
). Default tostale
mode.GLUU_CONFIG_CONSUL_SCHEME
: supported Consul scheme (http
orhttps
).GLUU_CONFIG_CONSUL_VERIFY
: whether to verify cert or not (default tofalse
).GLUU_CONFIG_CONSUL_CACERT_FILE
: path to Consul CA cert file (default to/etc/certs/consul_ca.crt
). This file will be used if it exists andGLUU_CONFIG_CONSUL_VERIFY
set totrue
.GLUU_CONFIG_CONSUL_CERT_FILE
: path to Consul cert file (default to/etc/certs/consul_client.crt
).GLUU_CONFIG_CONSUL_KEY_FILE
: path to Consul key file (default to/etc/certs/consul_client.key
).GLUU_CONFIG_CONSUL_TOKEN_FILE
: path to file contains ACL token (default to/etc/certs/consul_token
).GLUU_CONFIG_KUBERNETES_NAMESPACE
: Kubernetes namespace (default todefault
).GLUU_CONFIG_KUBERNETES_CONFIGMAP
: Kubernetes configmaps name (default togluu
).GLUU_CONFIG_KUBERNETES_USE_KUBE_CONFIG
: Load credentials from$HOME/.kube/config
, only useful for non-container environment (default tofalse
).GLUU_SECRET_ADAPTER
: The secrets adapter, can bevault
orkubernetes
.GLUU_SECRET_VAULT_SCHEME
: supported Vault scheme (http
orhttps
).GLUU_SECRET_VAULT_HOST
: hostname or IP of Vault (default tolocalhost
).GLUU_SECRET_VAULT_PORT
: port of Vault (default to8200
).GLUU_SECRET_VAULT_VERIFY
: whether to verify cert or not (default tofalse
).GLUU_SECRET_VAULT_ROLE_ID_FILE
: path to file contains Vault AppRole role ID (default to/etc/certs/vault_role_id
).GLUU_SECRET_VAULT_SECRET_ID_FILE
: path to file contains Vault AppRole secret ID (default to/etc/certs/vault_secret_id
).GLUU_SECRET_VAULT_CERT_FILE
: path to Vault cert file (default to/etc/certs/vault_client.crt
).GLUU_SECRET_VAULT_KEY_FILE
: path to Vault key file (default to/etc/certs/vault_client.key
).GLUU_SECRET_VAULT_CACERT_FILE
: path to Vault CA cert file (default to/etc/certs/vault_ca.crt
). This file will be used if it exists andGLUU_SECRET_VAULT_VERIFY
set totrue
.GLUU_SECRET_KUBERNETES_NAMESPACE
: Kubernetes namespace (default todefault
).GLUU_SECRET_KUBERNETES_SECRET
: Kubernetes secrets name (default togluu
).GLUU_SECRET_KUBERNETES_USE_KUBE_CONFIG
: Load credentials from$HOME/.kube/config
, only useful for non-container environment (default tofalse
).GLUU_WAIT_MAX_TIME
: How long the startup "health checks" should run (default to300
seconds).GLUU_WAIT_SLEEP_DURATION
: Delay between startup "health checks" (default to10
seconds).GLUU_OVERWRITE_ALL
: Overwrite all config (default tofalse
).GLUU_AWS_SECRETS_ENDPOINT_URL
: The URL of AWS secretsmanager service (if omitted, will use the one in specified region).GLUU_AWS_SECRETS_PREFIX
: The prefix name of the secrets (default togluu
).GLUU_AWS_SECRETS_REPLICA_FILE
: The location of file contains replica regions definition (if any). This file is mostly used in primary region. Example of contents of the file:[{"Region": "us-west-1"}]
.AWS_DEFAULT_REGION
: The default AWS Region to use, for example,us-west-1
orus-west-2
.AWS_SHARED_CREDENTIALS_FILE
: The location of the shared credentials file used by the client (see https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).AWS_CONFIG_FILE
: The location of the config file used by the client (see https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).AWS_PROFILE
: The default profile to use, if any.GOOGLE_APPLICATION_CREDENTIALS
: Optional JSON file (contains Google credentials) that can be injected into container for authentication. Refer to https://cloud.google.com/docs/authentication/provide-credentials-adc#how-to for supported credentials.GOOGLE_PROJECT_ID
: ID of Google project.GLUU_GOOGLE_SECRET_VERSION_ID
: Gluu secret version ID in Google Secret Manager. Defaults tolatest
, which is recommended.GLUU_GOOGLE_SECRET_NAME_PREFIX
: Prefix for Gluu secret in Google Secret Manager. Defaults togluu
. If leftgluu-secret
secret will be created.
Commands
The following commands are supported by the container:
load
dump
load
The load command can be used either to generate or restore config and secret for the cluster.
Docker
-
To generate the initial configuration and secret, create
/path/to/host/volume/generate.json
similar to example below:{ "hostname": "demoexample.gluu.org", "country_code": "US", "state": "TX", "city": "Austin", "admin_pw": "S3cr3t+pass", "ldap_pw": "S3cr3t+pass", "email": "s@gluu.local", "org_name": "Gluu Inc." }
NOTE: starting v4.3.x,
generate.json
has optional attributes to generate oxAuth signing and encryption keys based on specific algorithms.auth_sig_keys
: space-separated key algorithm for signing (default toRS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512
)auth_enc_keys
: space-separated key algorithm for encryption (default toRSA1_5 RSA-OAEP
)
-
Mount the volume into container:
docker run \ --rm \ --network container:consul \ -e GLUU_CONFIG_ADAPTER=consul \ -e GLUU_CONFIG_CONSUL_HOST=consul \ -e GLUU_SECRET_ADAPTER=vault \ -e GLUU_SECRET_VAULT_HOST=vault \ -v /path/to/host/volume:/opt/config-init/db \ -v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \ -v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \ gluufederation/config-init:4.5.1_dev load
Kubernetes
-
To generate the initial configuration and secret, create
/path/to/host/volume/generate.json
similar to example below:{ "hostname": "demoexample.gluu.org", "country_code": "US", "state": "TX", "city": "Austin", "admin_pw": "S3cr3t+pass", "ldap_pw": "S3cr3t+pass", "email": "s@gluu.local", "org_name": "Gluu Inc." }
NOTE: starting v4.3.x,
generate.json
has optional attributes to generate oxAuth signing and encryption keys based on specific algorithms.auth_sig_keys
: space-separated key algorithm for signing (default toRS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512
)auth_enc_keys
: space-separated key algorithm for encryption (default toRSA1_5 RSA-OAEP
)
-
Create config map
config-generate-params
kubectl create cm config-generate-params --from-file=generate.json
-
Mount the configmap into container and apply the yaml:
apiVersion: batch/v1 kind: Job metadata: name: config-init-load-job spec: template: spec: restartPolicy: Never volumes: - name: config-generate-params configMap: name: config-generate-params containers: - name: config-init-load image: gluufederation/config-init:4.5.1_dev volumeMounts: - mountPath: /opt/config-init/db/generate.json name: config-generate-params subPath: generate.json envFrom: - configMapRef: name: config-cm args: ["load"]
- To restore configuration and secrets from a backup of
/path/to/host/volume/config.json
and/path/to/host/volume/secret.json
: mount the directory as/opt/config-init/db
inside the container:
-
Create config map
config-params
andsecret-params
:kubectl create cm config-params --from-file=config.json kubectl create cm secret-params --from-file=secret.json
-
Mount the configmap into container and apply the yaml:
apiVersion: batch/v1 kind: Job metadata: name: config-init-load-job spec: template: spec: restartPolicy: Never volumes: - name: config-params configMap: name: config-params - name: secret-params configMap: name: secret-params containers: - name: config-init-load image: gluufederation/config-init:4.5.1_dev volumeMounts: - mountPath: /opt/config-init/db/config.json name: config-params subPath: config.json - mountPath: /opt/config-init/db/secret.json name: secret-params subPath: secret.json envFrom: - configMapRef: name: config-cm args: ["load"] ```
dump
The dump command will dump all configuration and secrets from the backends saved into the /opt/config-init/db/config.json
and /opt/config-init/db/secret.json
files.
Docker
Please note that to dump this file into the host, mount a volume to the /opt/config-init/db
directory as seen in the following example:
docker run \
--rm \
--network container:consul \
-e GLUU_CONFIG_ADAPTER=consul \
-e GLUU_CONFIG_CONSUL_HOST=consul \
-e GLUU_SECRET_ADAPTER=vault \
-e GLUU_SECRET_VAULT_HOST=vault \
-v /path/to/host/volume:/opt/config-init/db \
-v /path/to/vault_role_id.txt:/etc/certs/vault_role_id \
-v /path/to/vault_secret_id.txt:/etc/certs/vault_secret_id \
gluufederation/config-init:4.5.1_dev dump
Kubernetes
apiVersion: batch/v1
kind: Job
metadata:
name: config-init-load-job
spec:
template:
spec:
restartPolicy: Never
containers:
- name: config-init-load
image: gluufederation/config-init:4.5.1_dev
command:
- /bin/sh
- -c
- |
/app/scripts/entrypoint.sh dump
sleep 300
envFrom:
- configMapRef:
name: config-cm
Copy over the files to host
kubectl cp config-init-load-job:opt/config-init/db .