Thanks everybody, can you hear me well?
Fine.
So, my name is André Boscaro.
Can you hear me well?
Okay, I will do this way.
My name is André Boscaro.
It's my first time at Fossdom.
I'm a bit anxious and nervous.
So, please stay with me and to the end.
I am a senior product owner for the identity and access management in REL,
specifically for SSSD, Symba, and IDM insights,
which is the team behind what we did here that I present today.
So, this is the agenda.
We have the problem.
We want to, we have to solve the pain-free
management in hybrid cloud environments.
The solution overview, which is called the Podango project.
We will get there.
Some brief technical details, because I'm just a product owner.
So, we have more people who are skewed than me to explain that,
but I will do my best.
And we have documentation and other stuff.
Demo time and some gaps in future opportunities.
We identified it.
So, just briefly speaking about me.
I work in the identity and access management team at RELHET,
as I previously mentioned.
The Podango project is the hard work of
a small team inside the entire identity and access management department.
So, brilliant minds will get together to solve this,
and it was pretty amazing work with them.
This presentation is also a collaboration.
So, previous week, it was presented at open everything,
open in Australia.
And today we are presenting here at Fauston,
and in the next few weeks, it will be presented in the
confinja.
So, we are making a huge effort to spread the message about this.
And about myself.
I love to listen to other people's stories.
So, if you see me, just come by and let's have a chat.
I also learned to play through those words.
It's a challenge that I put to myself,
and I probably would get there sometime.
And I'm a Brazilian, living in Europe for the past five years.
And it's an incredible experience so far.
So, I'm really loving it how Europeans are welcome foreigners.
So, I really thank you everybody here.
I assume it knowledge.
So, a basic understanding of the computing cloud providers and VMs.
Basic and intimate concepts like holding users, hbacks, etc.
If you don't know those things, don't worry.
We have experts here in the room that they can help you.
Save your questions for a later.
That we would try to address them all.
So, what problem are we trying to solve?
Imagine that you launched a virtual machine.
Some questions just come to your mind.
I'll do a authentication to that machine.
Most often you have SSH key ready configured during the launch.
But other questions may raise in a later future.
How does it authentication to other machines or services?
What if many users need to access the machine or different workloads?
So, are you sharing our SSH keys?
Do you have a single one to everybody?
We know like assistant admins, how we serve her about it.
And if someone leaves the company, are you need to revoke access to something?
Are you changing everything again?
So, not a good practice.
How do you for a sexist policies?
So, we came up with brainstorming some ideas.
We know that SSH keys they work, but they don't scale well.
If you have to scale that, you have to use SSH certificates,
but require some special purpose PKI.
Privilege account management, 30-part solutions.
We are in an open-source conference.
I will not talk about that.
Corporate IDM, which is free IPA behind it.
Need to real client somehow.
So, every time a machine is launched,
we have to somehow enroll it in this server.
And corporate cloud-based IDM, which is in 3D.
Not much here.
So, we didn't touch that area.
We are trying to, but we are not getting there yet.
So, if I'm here, of course, we chose free IPA.
Basically, this is the problem statement in a single image.
So, imagine that we have the existing courses in the organization,
and the domain using the free IPA.
So, we have the servers.
We have all the clients enrolled there.
And you just have a new recent provided host.
So, how do you manage that?
So, this is the entire problem, because we have the SSH keys,
or whatever you are using to this new provided host.
It's that secure during the time delay
until the machine is not enrolled in the server.
You have to have a manual intervention.
Intervention are a 30-part solution to handle that.
And you don't want to share your credentials or leave it as it is.
So, we wanted to come to that area to that solution
in an automated fashion way.
So, in the bottom line, we wanted to reduce the complexity
and the cost using something automated.
We don't want to sacrifice security in the name of the convenience,
because we know how painful it is to do that manually
and every day thing.
And we want to use our already existing IPA service,
whatever you have in the IDM system, to use whatever you
already configured all the users, all the privilates, and everything.
Let's take account of that and use that.
Why do you have to create everything from scratch?
And here it comes the podango.
And we installed the podango inside this hybrid cloud console.
I will not talk about the hybrid cloud console.
We just use it for services and how I would demonstrate it.
But you can use it on your own.
So, this is podango.
And of course, this dog is really cute.
And why we chose this dog name?
Because it's a bridge with three sub-breeds, a lot of cabers.
So, we found it was a voting and of course, it won.
The containers are using pod and it was written in the goal language.
And every project should have t-shirts.
That's we were discussing before and acute mascot.
So, encourage you to find mascots for our projects.
And here's the podango project website in GitHub.
So, it contains, it's splitting to four things.
We have the IDM, CFC backhand, which is the running in the red hat hybrid cloud console,
which is the podango service as we name it later on in the presentation.
It has the open API spec.
If you are interested in it, we have the front end where you can make some configurations
and interact with the podango service backhand.
And we have two RPMs, the IPA, CCC server and the client, which perform the enrollment
and the configuration, the service and the enrollment later on when the machine is launched.
Briefly speaking about this, this is the infrastructure.
We installed the podango service.
So, our customers, they want to have the machines there.
So, there is already pre-configured.
They have this infrastructure, has a subscription manager.
So, it knows about all the machines and the new recently launched ones.
So, when you use the podango service at your own, you have to take that account
to check in your infrastructure.
So, basically, it's this opera has three acts.
First, you register your domain in the podango services.
Hey, this is my IP service.
This is the domain. Please make sure you have it written there.
The second step, I will just mention, but we are not like focusing on it.
This hybrid cloud console has a way to create images.
So, pretty much you just create an image, but in this case, you have to create
with the RPM packages.
So, your VM has this IPCC server in the client.
So, once it's launched, it triggers the ACC client and tries to connect the IP service.
And the last step, launching the machine itself, which we have a demo,
and I would try to show that.
So, this is what we achieved with the domain join.
We leverage the existing IAM.
So, you don't have to worry about creating everything from scratch.
It's automates and emitted.
And by immediately, I say less than two minutes.
We try to record it.
And we figured out some other 30 part things take more time than just immediately.
So, we can discuss that later on.
But briefly speaking, two minutes in your infrastructure.
The machine is launched and the connection happens before it.
It will be faster than here.
And no credentials seen by the service in this case,
HCC or your podango service or whatever you try to use with our own.
How does it work?
Yay, diagrams.
So, we can split into two workflows.
The first one is this registration.
Where you go to podango service and you register the domain.
And it later on can, hey, my machine is trying to connect.
And here at the IP service and the things,
you have to connect or to talk to.
And the second flow is when the machine is actually launched.
So, the machine is launched.
Hey, I'm alive.
I want to connect.
Someone told me to reach out to you.
Let's go ahead and do the transactions.
So, the first one.
One dot one.
When the user goes to the guy and tries to register the domain join,
it creates a token.
And the user later on comes to the IP service and executes the IP.
It's a see register with the token generated from the podango service.
The IP service, we enroll it and generate and give all the details.
This is the domain join.
This is the domain.
We have this of services.
This is the topology.
And one dot three calls the domains.
And the podango service will restore this in its own database.
So, once the machine is launched later on,
I need to connect.
Give me a list of services.
Give me the topology and all the details that I need.
Once everything happens successfully,
once the user launched a client via a machine,
this is what happens.
So, the machine is alive.
Hey, I'm alive.
What should I do?
So, it calls the podango service in the host conf.
With the authorization token, it's sign it.
Oops.
It's a other iterative sign it by the podango service.
And once the podango service recognizes that,
okay, it's fine.
Let's go ahead.
It retrieves the information from the database.
Okay, this is the domain you have to join.
And this is the author.
The sign it authority token.
You have to talk to that IP server.
This is the response to the three.
Two dot four.
The client tries to request, hey, the podango service.
Asked me to talk to you.
I want to roll in this IPA server.
It's just remembered that the sending the token
authorited by the podango service.
The HTCC server recognizes that call.
And okay, you are allowed to proceed.
Let's enroll you in our IP server.
Call in the 2.5 IP host add.
So, all the things happen behind the scenes.
And then 2.6, it performs a different IPA client install.
Which install the IP client in that machine.
And then it performs a key.
Cabrals, PKI in it, and get to the key tab,
and installs everything there.
Hopefully, I did not miss anything.
So, turbo shooting this.
Our team faces a lot of issues.
So, we try to share because it's sharing is caring.
Several things have to be just right for this to work.
So, while we did the presentation at the demo,
you have to make sure the DNS, of course, it's always DNS.
The problem.
You have to make sure that the machines are visible,
which are all during the same VPN in the same zone.
They have like the firewalls and all these stuff.
So, it happens the connections and the calls.
HCC and IP server must be reachable from the cloud environment.
That's pretty much what I said.
DNS routes and firewalls can cause all problems and troubles.
And IP uses a lot of ports.
So, be mindful that a lot of calls with HPs, LDAPs, and the cabrals.
So, it will happen behind the scenes.
So, just investigate the firewalls and all the things
if they are available to each other and they are seen each other.
So, demo time.
I will skip the registration because it's pretty early for what I mentioned.
You pretty much registered the domain here and that's all.
The server, the podango service, we will know, okay.
When a machine is launched, it will connect to this server.
The building on image, I will skip it for sure,
because it talks about the HCC cloud,
which is not the goal for this presentation.
And this is the demo.
Since we don't have a sound, I would do my best to do whatever
for sure, record it here and explain it way better than I did.
So, here we are in the HCC hybrid cloud console.
So, here's the domain.
So, when you create our infrastructure, this is the podango service behind the scenes.
We just created, okay, this is the domain we want to join.
It has five minutes.
I have to synchronize the freezer.
So, those are the tails and we have an image with the IPNs.
So, here's just the most rating that we created the image.
We set up the domain and now we can launch a machine with the proper IPNs.
Probably, if you are using AWS, you have to select whatever the instance you want.
And we have the template using the IPHCC server or client, sorry.
I'm all free here.
Once the machine is launched, now here we have, we will not use SSH keys,
because otherwise, I wouldn't be here presenting that.
It's an automated and fashion way, but this wizard flow requires to have an SSH key.
So, we are just following other things guidance.
But we actually don't need it in the end.
So, here we review it.
We launch it.
We just wait for the IP address.
Yep.
It's there.
So, the machine is launched.
So, here it's where the two minutes that is privileged mentioned happen.
So, the machine is launched.
The RHSEM, which our subscription manager will be aware of the machine.
We have something other things called like insights and other stuff.
They will all orchestrate that.
And it takes more or less two minutes until our server has awareness of the machine,
because of all the transactions happening.
But in your infrastructure, if you make it faster, it will be faster.
I know that Frazier will in this demo.
If you watch it live in the later on in the YouTube, the care code is there,
but it cuts a bit.
So, the presentation is available.
Frazier speaks about all the technical details, which I don't remember so far.
But first, he will wait for the two minutes for all the things we were facing.
And he will go to the host at the IP server to make sure.
Okay.
Yes.
So, the server is there.
It's already rolled.
And we are using our external IDP.
So, we configured the user to go to GitHub and sign it that.
So, the entry is already rolled.
The machine is already there.
As you can see, IP address is there.
And it's available.
And we selected to authorize through the external IDP using GitHub.
So, now we will make the connection.
It will give us a link to GitHub and a ping.
In case you don't know about the external IDP, we have a presentation later today.
We've sum it at no 35.
And he will probably give further details about it.
So, you have access that URL.
Insert the ping.
Authorize.
And yay.
You have a carburetor's ticket.
So, you are logged with the external IDP user.
In the domain, we showed.
What are the status gaps and possible futures?
The futures in production, but in preview mode.
The IP, HTC, server, and clients are both available in the app and Fedora.
The documentation is published.
But needs expansion.
Cloud providers, they have onboarding guides to come.
We are collecting metrics for users and customers.
I am responsible for that.
So, we can understand better.
Why is preventing you to use this feature?
So, not the last one, but the feedback from you is really important.
So, whatever you see, whatever you want to share with me, please reach out to us.
It's more than a pleasure to listen from you.
What we can help and how we can improve this.
So, everybody can take advantage as we do as community.
And we have one limitation is one active domain per organization.
What come next?
Okay.
As Alexander mentioned before yesterday, Microsoft, in the 90s, they were really smart and clever.
They took all the things that they have to work with customers.
An active director is mainly used for our customers.
So, yes, probably we have to add that support to make them happy.
And we can expand the solution to more organizations.
But we started with free APA.
Very fire assist users with cloud environment setups.
So, we know how the hype of the cloud is there.
And people are using that a lot.
So, why can't we help them to achieve the security with that?
Support for multiple domains, domains, and other HTC specific integrations.
So, a great vision is to have a single place where you can enroll your machines
and can have everything under control in a single place.
So, you don't have to go in multiple different directions and do this here.
Do that there.
This is a way to have a single unified it.
It's the main.
So, option one is if I pay with external IDP as we demonstrate it.
And please don't miss some in stock at nine, nine, nine, 35.
And option two, it's using local KTC.
I'll extend it under the rest.
Schneider will present that at 1335.
If you're interested, don't miss it.
If you want to use it, you're on.
I would just leave some sharing is carry.
So, this is what happened.
Our architecture is not tightly bound to hybrid cloud console,
but on the other hand, shameful truth, the code kind of is.
So, if you want to use it, you have to implement some authority authentication calls.
Using X509 or something else using the OTP join.
This is the diagram that I wanted to show you.
So, all those calls here from the Podango service to the IP server and the clients.
They are authenticated.
And now, so, this is 2.4 and the 2.7.
So, if you want to implement in your infrastructure, please be mindful about that,
because it won't work otherwise.
And if you get a use case, again, please share with us.
I'm Martin, gladiator, to listen from you and to help with whatever we can with our team.
Conclusion.
So, there are a bunch of links here and the commentations.
And this is also this slide deck is here, and if you want to reach out to me,
I don't have social media, I just have the link thing, which nowadays it's becoming a social media,
but whatever they name it, please feel free to connect.
And let's have a chat if you find me here.
And questions.
Any question?
Thank you.
Thank you everybody.