i4Trust Consumer Demonstrator

App-of-apps for an i4trust data service consumer organisation (e.g., Happy Pets).

💡 This repository just provides a setup for temporary demonstration purposes. It is not recommended to be used in a production enviroment. Credentials are visible in clear text and are not encrypted. Installations should be deleted when demonstrations/presentations/etc. have finished.

The GitHub actions of this repo are configured to deploy a full instance with all components required for this demonstrator, as soon as a branch is created. It is meant for a temporary deployment only. Note that the deployment should be deleted after each presentation/demo/etc., since there are only test accounts registered and credentials are visible in clear text in this repo.

Before moving this installation to a production environment, make sure to encrypt all credentials, keys, etc., e.g., using sealed-secrets.

All scripts are developed for using an OpenShift Kubernetes cluster, but can be easily adapted for any kind of infrastructure.

Deployment

It is required to setup two GitHub secrets in the repository (also check this manual):

• OPENSHIFT_SERVER: Server URL of the OpenShift cluster
• OPENSHIFT_TOKEN: Token from an OpenShift service account with sufficient permissions for creation/deletion of projects and applications, role assignments and deployments via Helm charts (e.g., with cluster-admin role)

In order to deploy all components, simply create a branch which is named differently than main. The GitHub action will deploy all components to the namespace i4t-consumer-{BRANCH_NAME}.

• Branches named no-deploy/** will not be deployed. This is useful in the case that one first wants to develop a new configuration without deploying it immediately. For deployment after finishing the development, one simply creates a branch out of the no-deploy/** branch named differently than main and no-deploy/**.

Routes for externally exposed services are automatically created and hostnames are set dynamically. In order to retrieve the created hostnames, one can run, e.g.,

kubectl -n i4t-consumer-{BRANCH_NAME} get routes

or check in the OpenShift console or in ArgoCD.

Uninstall

For removing all components and deleting the applications and namespace, simply remove the branch.

Credentials

Different accounts are created automatically with default passwords.

Component	Username	Password	Comment
Keyrock Consumer	[email protected]	admin	Admin user of the Consumer Keyrock IDP
Keyrock Consumer	[email protected]	operator	Operator employee user of the Consumer
Keyrock Consumer Shop	[email protected]	admin	Admin user of the Consumer Shop Keyrock IDP
Keyrock Consumer Shop	[email protected]	prime	Prime user of the Consumer shop system
Keyrock Consumer Shop	[email protected]	standard	Standard user of the Consumer shop system
Keycloak Consumer Admin Console	fiwareAdmin	fiwareAdmin	Admin user of the Consumer Keycloak
Keycloak Consumer	[email protected]	prime	Prime user of the Consumer Keycloak
Keycloak Consumer	[email protected]	standard	Standard user of the Consumer Keycloak

Root CA, keys and certificates have been created and self-signed using openssl. Keys and certificates used for this demonstrator can be found in the certs folder. These should never be used in any kind of production enviroment or on a contineously running environment.
Below table displays the assigned EORIs and DIDs assigned to the different organisations and their keys/certificates:

Organisation	EORI	DID
Consumer	EU.EORI.DECONSUMERONE	did:key:z6MkpMwCqXiva7WiqDuiDtThG6SAupwUVmpeaYrbF7KQHB8v