Evaluate IdentityFlow in Kubernetes

Build locally

Package your delivered Linux program and installed starter in a local image. Build the image.

Sign in over HTTPS

A mock identity provider supplies test accounts through TLS ingress. Start the cluster.

Approve a vacation

The starter’s Acme hook gives the manager authority to answer the dialog. Complete the request.

One local cluster connects the delivered program, mock sign-in and vacation approval.

You can sign in as a test account, start a vacation request and approve its dialog without connecting your organization’s identity provider. First prepare the delivered starter and Linux x64 program, then build the local image below. A dialog is a workflow step that waits for a person’s answer; see Concepts for the domain terms.

Evaluation only

The mock provider accepts invented identities. PostgreSQL stores data only for the lifetime of its pod. Use this example on your own disposable local cluster; it provides neither production authentication nor durable storage.

Before you start

You need Docker, kubectl, OpenSSL, curl 7.71 or newer, Node.js and ni, plus the delivered starter, Linux x64 program and an IdentityFlow repository checkout containing docs/examples/kubernetes-evaluation/. Ask your Kenoxa contact for the example files if you do not have the checkout. Run the commands from its root.

The cluster uses k3s v1.33.5-k3s1 in a privileged Docker container and serves HTTPS on loopback port 443; its API uses loopback port 16443. Both ports must be free. The node uses the Docker server’s native architecture; the IdentityFlow image runs Linux/amd64. ARM hosts need amd64 emulation for that image. The helper waits for CoreDNS to confirm pods can start; first image pulls can take several minutes. Browsers resolve the reserved .localhost names to loopback without public DNS. The curl checks use --resolve to set that route explicitly while still verifying TLS.

The example creates a private kubeconfig under the new /tmp/w2c-333-evaluation directory. Every Kubernetes command names that file explicitly. Keep using it: your default context may point at a different cluster.

Build the local image

Replace both absolute paths with the files you received. There is no published IdentityFlow image: you build it from the downloaded program. The helper uses the optional runtime image recipe, then adds the starter’s source, fixture data and installed dependencies. Its allowlist excludes the starter’s local settings and certificates.

starter=/absolute/path/to/identity-flow-workshop-starter-v0.3.1
program=/absolute/path/to/identity-flow-v0.3.1-linux-x64
(cd "$starter" && ni --frozen)
sh docs/examples/kubernetes-evaluation/build-image.sh "$program" "$starter"

The result is the local image w2c-333-identity-flow:local. The Workflow Test distribution is not included in this runtime image.

Start the local cluster

Choose a state directory that does not exist. The commands create the cluster, import your local image and apply the example. apply.sh generates a seven-day evaluation certificate authority (CA), signs the ingress certificate and mounts its public certificate into IdentityFlow with NODE_EXTRA_CA_CERTS.

state=/tmp/w2c-333-evaluation
sh docs/examples/kubernetes-evaluation/local-cluster.sh "$state"
docker save w2c-333-identity-flow:local | docker exec -i w2c-333-k3s ctr images import -
sh docs/examples/kubernetes-evaluation/apply.sh "$state/kubeconfig" "$state/tls"

The final check must print ready. Its bounded retries cover transient ingress errors while retaining TLS verification. It waits for initialization, migrations, workflow loading and OIDC discovery. Startup and readiness probes use the same /-/ready HTTP endpoint. Inspect startup failures with:

kubectl --kubeconfig "$state/kubeconfig" --namespace identity-flow-evaluation get pods
kubectl --kubeconfig "$state/kubeconfig" --namespace identity-flow-evaluation logs deployment/identity-flow
curl --fail --noproxy flow.localhost --retry 10 --retry-all-errors --retry-delay 2 --max-time 10 \
  --resolve flow.localhost:443:127.0.0.1 --cacert "$state/tls/ca.crt" \
  https://flow.localhost/-/ready

The two HTTPS addresses are https://flow.localhost for IdentityFlow and https://oidc.localhost/workshop for the issuer. Inside the IdentityFlow pod, hostAliases routes the issuer hostname to Traefik’s Service IP. That keeps issuer and callback addresses consistent between browser and pod, with TLS verification enabled. Plain HTTP pod-service issuer URLs are rejected; development/workshop mode does not make them valid in a cluster.

Import $state/tls/ca.crt into your disposable evaluation browser’s trust store before signing in. Import only the CA certificate, never ca.key or tls.key. The CA is private to this example and expires after seven days.

Complete one vacation request

1. Open IdentityFlow and choose sign in. On the mock login form, use subject 00000000-0000-4000-8000-000000000002, the starter’s vacation manager. In Optional claims JSON value, paste these claims, then choose Sign-in.

{ "name": "Vacation manager", "email": "vacation-manager@workshop.test" }

2. Open Workflow catalog, select Vacation approval and start a request for Requesting employee. Enter a valid first and last day and a reason.
3. Open Assigned to me and the pending decide vacation request dialog. Select approved, enter a note and submit. The instance should complete and show the recorded decision.

The example reuses the starter’s vacation workflow and Acme identity hook. The manager belongs to division:OPERATIONS, which the small access configuration allows to start and view vacation requests, and holds role:vacation-approver, which the dialog requires. Signing in with an arbitrary mock subject grants no such authority. The mock is ghcr.io/navikt/mock-oauth2-server:2.1.10, the same version pinned by the starter.

What the files configure

All files live in docs/examples/kubernetes-evaluation/:

File	Purpose
identity-flow.yaml	One replica, Recreate updates, read-only filesystem, temporary memory volume and HTTP readiness probes.
identity-flow.conf	PostgreSQL owner connection, HTTPS OIDC issuer and callback, origin routing, hooks and vacation workflow discovery.
identity.hooks.ts	Registers the starter’s Acme provider and assignee resolver with fixed standard coverage.
authorization.ts	Grants starter and viewer access to the OPERATIONS division and activates it at startup.
postgres.yaml, init-postgres.sh	A disposable evaluation database; IdentityFlow connects as the NOSUPERUSER owner.
oidc.yaml, mock-oauth2.json	Mock login and audience configuration.
ingress.yaml	Traefik TLS routes for the browser and issuer hostnames.

For a real installation, replace the mock with your own provider, review identity mapping and authorization, and use durable PostgreSQL. Follow Install IdentityFlow and Connect an identity provider. This evaluation makes no availability claim for multiple replicas.

Remove the evaluation

This stops the local cluster and removes its named network and the two locally built application image tags. It does not remove Docker volumes or shared bases.

sh docs/examples/kubernetes-evaluation/cleanup.sh

Remove the private state directory when you no longer need it; it contains local administrator credentials, generated passwords and private keys.