This will set up a new demo environment that will show off the features of a Conjur Enterprise in conjunction with common devops tools. The tools are all docker containers that are all mapped to the same docker network to all for DNS resolution of the docker container name.
The demo uses the lastest version of Conjur v5
cdemo
will automatically pull Conjur OSS if there is no tar file or
Conjur docker registry access.bin/install-ansible
ansible --version
. conjurDemo/inventory.yml
to include any machines to be stood up as
demo machines, and to select which tools are installed. Set each tool
variable to 'YES' to install it automatically. Set to 'NO' to skip it. Some
services (Conjur, Gogs, Jenkins) are required and installation of cdemo will
not finish without them.bin/install
to install cdemo.bin/clean-environment
.Note: Ansible with PAS jobs can be deployed by setting the variable
"ansible_pas: 'YES'" in conjurDemo/inventory.yml
By default, cdemo will build with Conjur Open Source which is available to everyone as LGPL software. However, if you have access to Conjur Enterprise, cdemo can use that instead.
In order to enable Conjur Enterprise, you need an archive containing the Conjur Enterprise appliance image in the root directory of cdemo (same as this readme.)
If you have access to a Docker registry containing Conjur Enterprise you can create the acrhive yourself like so:
$ docker image save registry.local/conjur-appliance:5.0-stable | gzip -c >conjur.tgz
If you don't have access, you can download the archive file from your CyberArk support vault or contact CyberArk sales to get access. After downloading the arcvhive file, move it to this folder.
Note: in order to be recognized as a Conjur Enterprise archive file, it must have one of these names:
conjur.tar
conjur.tar.gz
conjur.tgz
Any other archive file(s) will be ignored.
In this case, you can enable Conjur Enterprise with these steps:
cdemo/conjurDemo/roles/conjurConfig/defaults/main.yml
conjur_version
to EE
conjur_EE_image_name
to the fully qualified name of the Conjur
Enterprise appliance image in your local registry.Now cdemo will use Conjur Enterprise without requiring an archive file.
The Conjur CLI will be pre-configured to work with the Conjur container. Inside
the CLI container, the scripts folder is mounted to /scripts
.
The tools installed have a web interfaces that is made accessible to the host machine on the following network ports:
Tool | Port |
---|---|
Jenkins | 6060 |
Gogs | 10080 |
Ansible Tower | 8080 |
Conjur | 443 |
Weavescope | 4040 |
If using v5 Enterprise Edition:
Tool | Port |
---|---|
Splunk | 8000 |
Jenkins and Gogs are connected via an internal docker network. Updating a job in Gitlab will be reflected in the subsequent Jenkins job at runtime.
AWX and Gogs are connected via an internal docker network. All projects in AWX have source code in Gogs.
There are scripts that are copied into the conjur-cli
container that will
interact with Conjur via REST calls to step through:
The scripts are located in /scripts. You can connect to the conjur-cli
container with:
$ sudo docker exec -it conjur-cli bash