TUI/CLI install on k8s?

[ksully-execute]

After k8s install, is the TUI (or CLI) already installed, and if not, do we just install it in one of the pods?
I checked the auth-server and config-api pod, and the cli directory isn't there.....I only see a standalone install page https://docs.jans.io/v1.0.15/admin/config-guide/jans-tui/#standalone-installation
I assume we don't install it on another machine since it's going to talk to the config-api, is that the best practice?
Sorry for the remedial question

[moabu]

hey @ksully-execute ,

You either build it from scratch or you download it from the release assets depending on the OS you are running it from https://github.com/JanssenProject/jans/releases/tag/v1.0.15 .

The config API should be exposed to the AS and internal services and to the managing or VPN network of devs . Therefore, from where you normally interact with your k8s cluster would probably be the best place to interact with the config API since it would have access to it. Here is a short how to :

FQDN=demoexample.jans.io
# Notice the namespace is jans here . Change it if it was changed during installation of janssen previously
TUI_CLIENT_ID=$(kubectl get cm cn -o json -n jans | grep '"tui_client_id":' | sed -e 's#.*:\(\)#\1#' | tr -d '"' | tr -d "," | tr -d '[:space:]')
TUI_CLIENT_SECRET=$(kubectl get secret cn -o json -n jans | grep '"tui_client_pw":' | sed -e 's#.*:\(\)#\1#' | tr -d '"' | tr -d "," | tr -d '[:space:]' | base64 -d)
# add -noverify if your fqdn is not registered
./config-cli-tui.pyz --host $FQDN --client-id $TUI_CLIENT_ID --client-secret $TUI_CLIENT_SECRET

[ksully-execute]

@moabu so I downloaded the pyz, and can run it on a command k8s node, and I get the 'Janssen Config API Client Credentials' panel, with no clients being shown.
Though I see docs here: https://docs.jans.io/v1.0.16/admin/config-guide/jans-tui/#administration
I don't see any docs that explain how to get these values.....
Am I missing something?

[moabu]

This looks like you haven't signed in. You should be prompted for the device code flow and sign in . Then you should be connected

[ksully-execute]

ok, making progress, with V1.0.16-1 running, auth server well known endpoints are responding ok with cilium ingress, and I can start the TUI.
But, using your script above, it does get a client id and client secret, and I'm using the same hostname which is defined in the jans override file, and that hostname is defined in dns used by all cluster machines.
TUI reports "Error Connecting to Auth Server".
Any clue for me?
override.post.txt

not sure it's related, but I note that the well known endpoints for fido2 and scim are NOT responding ok when trying:
curl -k https://theFQDN/.well-known/fido2-configuration curl -k https://theFQDN/.well-known/scim-configuration
and when I try to hit the internal address for fido2 and scim, i get no response either.

k get svc fido2
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
fido2 ClusterIP 10.109.10.140 8080/TCP 25m
curl 10.109.10.140:8080/.wel-known/fido2-configuration

<title>Error 404 Not Found</title>

HTTP ERROR 404 Not Found

`

[moabu]

you have a typo . You can test internally by exec in the pod and hitting http://localhost:8080/jans-scim/restv1/scim-configuration .

Check to see if the ingeress was applied kubectl get ingress

[ksully-execute]

so when I run http://localhost:8080/jans-scim/restv1/scim-configuration in the pod, I do get a good response.
And given the ingress definition (below), I tried a few combos below, none kick out an error but also don't return anything.
curl http://jans.executeinc.com/jans-scim/scim-configuration`
curl http://jans.executeinc.com/jans-scim/restv1/scim-configuration

---ingress
`k describe ingress janssen-nginx-ingress-scim
Name: janssen-nginx-ingress-scim
Labels: app=janssen-nginx-ingress-scim
app.kubernetes.io/managed-by=Helm
Namespace: jans
Address: 172.16.1.2
Ingress Class: cilium
Default backend:
TLS:
tls-certificate terminates jans.executeinc.com
Rules:
Host Path Backends

---

jans.executeinc.com
/jans-scim scim:8080 (10.0.2.191:8080)
Annotations: meta.helm.sh/release-name: janssen
meta.helm.sh/release-namespace: jans
nginx.ingress.kubernetes.io/proxy-next-upstream: error timeout invalid_header http_500 http_502 http_503 http_504
nginx.org/ssl-services: scim
Events:
`
Thoughts?

[ksully-execute]

i see annotations for nginx listed in the describe of the ingress, but that's really matter should it?

[ksully-execute]

@moabu do you think I should open a bug about the ingress definition? (I'm using cilium and trying the latest build with cilium being the ingress)?