Skip to main content

Hello world protected wy SSO new generation (Pomerium)

tip

Click here to see our documentation for the SSO new Generation (Pomerium).

Prerequisites​

To run this onboarding tutorial, we should first have:

  • a k8saas cluster deployed
info

To ask and set up your own cluster, look at the section Getting Started.

warning

Your cluster must have Pomerium installed. Please ask the support team to install it using Thales postit portal.

And downloaded the following files:

Tutorial​

This application is a simple website application, with a SSO policy that only allows the thalesdigital.io domain.

Get your credentials​

az aks get-credentials  --name "$K8SAAS_RESOURCE_NAME"  --resource-group "$K8SAAS_RESOURCE_NAME" \
note

The cluster name and the resource group name are the same within k8saas.

Deploy the application​

Deploy the application, composed of :

  • a kubernetes Deployment object: which spin up the application pod (container) and make sure it's up and running at all time;
  • a kubernetes Service object: which exposes the pod internally.
warning

Before applying the configuration. We will need to update the downloaded files.

Update DNS zone​

You will need to update the file pomerium-ingress.yaml with the right DNS zone and at the same time we will change the host to be sure it's unique and not interfering with another project.

Look and replace:

spec:
  ingressClassName: pomerium
  rules:
  - host: <VALUE_TO_CHANGE>.demo-pomerium.<DNS_ZONE>
...
  tls:
  - hosts:
    - <VALUE_TO_CHANGE>.demo-pomerium.<DNS_ZONE>

With the DNS zone information that was in the onboarding email sent to you. If you do not have this information you can always run this:

note

Possible DNS Zone for K8SaaS clusters:

  • kaas.thalesdigital.io
  • k8saas.thalesdigital.io
  • prod.k8saas.thalesdigital.io
  • eu.k8saas.thalesdigital.io
  • eu2.k8saas.thalesdigital.io
kubectl get ingress -n monitoring

It should return something like this:

NAME                          CLASS   HOSTS                                                             ADDRESS         PORTS     AGE
prometheus-operator-grafana   nginx   grafana.k8saas-rbo-sandbox.eu.k8saas.thalesdigital.io        20.50.218.145   80, 443   389d

Now with the information from the previous command, update pomerium-ingress.yaml with the right information. Here we've replaced hello-world-ingress with rbo-sandbox-hw to be unique like suggested earlier.

spec:
  ingressClassName: pomerium
  rules:
  - host: rbo-sandbox-hw.demo-pomerium.eu.k8saas.thalesdigital.io
...
  tls:
  - hosts:
    - rbo-sandbox-hw.demo-pomerium.eu.k8saas.thalesdigital.io

Deploying the Hello World​

Using the following command will start an hello world pod

kubectl apply -f aks-helloworld-pomerium.yaml --namespace dev
# look at your pods
kubectl get pods -n dev
# NAME                                  READY   STATUS    RESTARTS   AGE
# aks-helloworld-one-56c7b8d79d-sm4c6   2/2     Running   0          10m

Expose the application​

The second file deploys a kubernetes Ingress object that binds the application to a DNS domain: e.g. rbo-sandbox-hw.demo-pomerium.eu.k8saas.thalesdigital.io.

And there is a SSO policy that only allows requests from the domain thalesdigital.io.

Use the command:

kubectl apply -f pomerium-ingress.yaml --namespace dev

Now, open a browser and consult your application: e.g. https://rbo-sandbox-hw.demo-pomerium.eu.k8saas.thalesdigital.io

If you are not sure of your hostname you can run this command:

kubectl get ingress -n dev
tip

Thanks to Pomerium and the SSO policy, you'll be asked to identify yourself and will be only allowed if you domain is thalesdigital.io

Remove your test​

$ kubectl delete -f aks-helloworld-pomerium.yaml --namespace dev
$ kubectl delete -f pomerium-ingress.yaml --namespace dev