You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: demo.ipynb
+13-6Lines changed: 13 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,14 @@
1
1
{
2
2
"cells": [
3
+
{
4
+
"cell_type": "markdown",
5
+
"metadata": {},
6
+
"source": [
7
+
"## Step 1 - Configure the Venafi control plane to for a new Firefly instance. \n",
8
+
"\n",
9
+
"This task would usually be done using the UI, however it can be fully automated using the API. As a convenience, and to get you started using Firefly in the shortest possible time, we will use a utility called \"elevate\" to do this. This will run in a Docker container and we'll use Docker Compose to orchestrate it. However before we can do this you need will need your API key as described in the project documentation. "
10
+
]
11
+
},
3
12
{
4
13
"cell_type": "markdown",
5
14
"metadata": {},
@@ -19,29 +28,27 @@
19
28
"* Policies: basic-demo\n",
20
29
"* Configurations: basic-demo\n",
21
30
"\n",
22
-
"For the purposes of this demonstrations some simple policies have been created. \n",
23
-
"\n",
24
-
"f\n"
31
+
"For the purposes of this demonstrations some simple policies have been created. "
25
32
]
26
33
},
27
34
{
28
35
"cell_type": "markdown",
29
36
"metadata": {},
30
37
"source": [
31
-
"Lets start by adding our Venafi cloud API key to the environment. The following command creates a new `.env` file that contains an API key that will be used by the Docker compose file to generate a working Firefly configuration. "
38
+
"Lets start by adding our Venafi cloud API key to the environment. The following command creates a new `.env` file that contains an API key that will be used by the Docker compose file to generate a working Firefly configuration. Replace the placeholder text with your own API key. "
4. Click the "Generate" button at the bottom of the page. You will then see options to view or copy the new key. Keep a note of the API key somewhere secure for later<figure markdown>
@@ -71,7 +83,7 @@ The intended audience for this playground is:
71
83
* Developers, SRE's and platform engineering teams wanting to learn more about the services that Info Sec teams should be providing
72
84
* Internal Venafi staff wanting to demonstrate Firefly to partners and customers.
73
85
74
-
## Get Started
86
+
## Getting Started
75
87
76
88
The quick-start demo runs entirely in Docker and consists of three container images that a pulled from the public Docker repositories.
77
89
@@ -106,24 +118,35 @@ To simplify the this demonstration, the project includes an interactive Jupyter
106
118
107
119
Before you can run Firefly, you must edit the `.env` file to include a valid Venafi cloud API key (referenced in the prerequisites) at the placeholder. This is the only thing you need to change.
108
120
109
-
```text title=".env file"
110
-
TLSPC_API_KEY=xxxxx-xxxxxx-xxxxxx-xxxxxx
121
+
The first task in the demo creates a `.env` file that is used to store a variable for the API key.
At this point you can either follow the instructions here and cut/past the commands into the terminal in the codesdpace, or just step through and run each of the cells in the `demo.ipynb` interactive notebook file.
130
+
131
+
### Step 1 - Configure the control plane
113
132
133
+
Every Firefly instance requires a valid service account, configuration and policy in the Venafi Control Plane (TLS Protect Cloud). For production, this task would often be completed by your InfoSec team. However, it might be undertaken by the platform engineering teams. Either way, you need to login to https://ui.venafi.cloud to create various config items.
114
134
115
-
You can now run a docker command to configure the Venafi Cloud control plane as follows:
135
+
To simplify this process and reduce the time it takes to get started, we will use the prebuilt `3goats/elevate` container that fully automates the creation of the service account, configuration and policy. It will also create a private key file `private-key.pem` and local firefly `config.yaml` in the `config` directory.
116
136
117
-
```bash
137
+
To do this use the following `docker compose` command. This will run only the `3goats/elevate` container.
138
+
139
+
???+ warning "Important"
140
+
141
+
Do not run the `docker` commands in the interactive `demo.ipynb` environment. Instead type or cut and past the commands into the terminal.
142
+
143
+
```bash title="Configure the Control Plane"
118
144
docker compose --profile control-plane up
119
145
```
120
146
121
147
You should see the following output. You should also the following new files in the `./config` directory.
122
148
123
-
***config.yaml** - This is a generated Firefly configuration that will be used to pass the Firefly instance some basic values that are required as part of the bootstrap process,
124
-
***private-key.pem** This is the private part of a generated key pair that will be used by firefly to authenticate to the Venafi Cloud control plane.
125
-
126
-
```bash
149
+
```bash title="Example output"
127
150
[+] Running 2/0
128
151
✔ Network firefly-quickstart_default Created 0.0s
129
152
✔ Container firefly-quickstart-elevate-1 Created 0.0s
@@ -148,3 +171,32 @@ elevate-1 |
148
171
elevate-1 exited with code 0
149
172
```
150
173
174
+
The following files will also be updated to include valid content.
175
+
176
+
***config.yaml** - This is a generated Firefly configuration that will be used to pass the Firefly instance some basic values that are required as part of the bootstrap process,
177
+
***private-key.pem** This is the private part of a generated key pair that will be used by firefly to authenticate to the Venafi Cloud control plane.
178
+
179
+
### Step 2 - Start Firefly and the local JWT service
180
+
181
+
Now that we've configured the Control Plane, we can now start the Firefly container `public.ecr.aws/venafi-images/firefly` and the `tr1ck3r/jwt-this`.
182
+
183
+
To do this use the following `docker compose` command. The `--profile demo` flag tells Docker to run only the `public.ecr.aws/venafi-images/firefly` and the `tr1ck3r/jwt-this` containers.
184
+
185
+
```bash title="Start Firefly & the JWT service"
186
+
docker compose --profile demo up
187
+
```
188
+
189
+
You should see the following output.
190
+
191
+
```bash title="Example output"
192
+
todo
193
+
.........
194
+
.........
195
+
.........
196
+
```
197
+
198
+
!!! note
199
+
200
+
The above command runs docker in interactive mode which means that the process does not exit.
0 commit comments