This directory contains all the base Kubernetes configuration files that may be used to deploy the Ping Cloud software stack onto a Kubernetes cluster. It allows anyone to set up a cookie-cutter Ping Software stack on a Kubernetes cluster for evaluation purposes. Currently only AWS EKS clusters are supported.
The software provided hereunder is provided on an "as is" basis, without any warranties or representations express, implied or statutory; including, without limitation, warranties of quality, performance, non-infringement, merchantability or fitness for a particular purpose. Nor are there any warranties created by a course or dealing, course of performance or trade usage. Furthermore, there are no warranties that the software will meet your needs or be free from errors, or that the operation of the software will be uninterrupted. In no event shall the copyright holders or contributors be liable for any direct, indirect, incidental, special, exemplary, or consequential damages however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of this software, even if advised of the possibility of such damage.
This repository is still under active development and should not be used at this time for production purposes due to potential breaking changes.
The following tools must be set up and configured correctly:
- kubectl (>= v1.14)
- kustomize (>= v3.2)
- envsubst (>= 0.20)
To set up the environment, the following environment variables must be exported at the very minimum:
- PING_IDENTITY_DEVOPS_USER
- PING_IDENTITY_DEVOPS_KEY
- BACKUP_URL
- TENANT_DOMAIN
The DEVOPS user and key may be obtained from the Ping DevOps GTE team here:
https://docs.google.com/forms/d/e/1FAIpQLSdgEFvqQQNwlsxlT6SaraeDMBoKFjkJVCyMvGPVPKcrzT3yHA/viewform
The TENANT_DOMAIN must be an AWS registered domain and hosted zone on Route53 in the same AWS IAM role (e.g. arn:aws:iam::555555555555:role/ROLE) as your EKS cluster. For example, if it is set to k8s-icecream.ping-devops.com, then ping-devops.com must be a valid DNS domain registered by some registrar (e.g. AWS Route53). There must also be a hosted zone created for it on AWS Route53. Refer to the AWS online documentation on how to set these up.
The BACKUP_URL must point to an s3 bucket on AWS. PingFederate in clustered mode (which is the default) requires an s3 bucket for high availability and fault tolerance.
To build the environment, simply run:
kustomize build https://github.com/pingidentity/ping-cloud-base?ref=master |
envsubst '
${PING_IDENTITY_DEVOPS_USER}
${PING_IDENTITY_DEVOPS_KEY}
${BACKUP_URL}
${TENANT_DOMAIN}' |
kubectl apply -f -
Monitor it by running:
kubectl get pods -n ping-cloud
When all pods are ready, you should be able to access the following URLs:
Pingfederate console:
https://pingfederate-admin.k8s-icecream.ping-devops.com/pingfederate/app
Pingfederate API:
https://pingfederate-admin.k8s-icecream.ping-devops.com/pf-admin-api/api-docs
Pingfederate runtime endpoint:
https://pingfederate.k8s-icecream.ping-devops.com
Pingfederate oauth playground:
https://pingfederate.k8s-icecream.ping-devops.com/OAuthPlayground
Pingaccess console:
https://pingaccess-admin.k8s-icecream.ping-devops.com
Pingaccess API:
https://pingaccess-admin.k8s-icecream.ping-devops.com/pa-admin-api/v3/api-docs/
Pingaccess runtime endpoint:
https://pingaccess.k8s-icecream.ping-devops.com
Pingaccess WAS console:
https://pingaccess-was-admin.k8s-icecream.ping-devops.com
Pingaccess WAS API:
https://pingaccess-was-admin.k8s-icecream.ping-devops.com/pa-admin-api/v3/api-docs/
Pingaccess WAS runtime endpoint:
https://pingaccess-was.k8s-icecream.ping-devops.com
Kibana console:
https://logs.k8s-icecream.ping-devops.com
Information on how to access the environments may be found here:
The configuration in this repository may be used as a base for any customer deployment by simply providing a kustomization.yaml file that looks like this:
kind: Kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
resources:
- https://github.com/pingidentity/ping-cloud-base/k8s-configs?ref=master
In addition, some overrides must be provided (e.g. via secret and configmap generators) for the DEVOPS user/key and the ingress URLs at a minimum. The kustomization.yaml in the root of this repository shows an example of how this can be done. More information on kustomize may be found here:
Then, a new environment may simply be created by running:
kustomize build . | kubectl apply -f -
Note that the manifest files only work with kustomize v3.1.0 or later. The kustomize that's included in kubectl is of an older version. So the following direct invocation from kubectl does not work at the moment.
kubectl apply -k .
Make sure that your branch name is sufficiently short (<37 characters)
When automatically testing with CI/CD, the URLs created are based on the git branch name. If this branch name is too long, AWS Route53 will not be able to generate the URLs and your tests will fail.
Gitlab push rules are set up to not allow you to push to the branch if this is the case, however, you can also add this git hook to prevent this from occurring before you even push to Gitlab:
❯ cat .git/hooks/pre-push
#!/bin/sh
CUR_BRANCH=$(git branch --show-current)
if [[ $(echo "${CUR_BRANCH}" | wc -c) -gt 37 ]]; then
echo "Your branch name is too long. Please shorten to 37 characters or less to comply with route53 max length requirements"
exit 1
fi