Q. Lets create a new JWT access token.


export UNAMESPACE={{UNAMESPACE}}


curl -X POST "https://${UNAMESPACE}.makelabs.in/auth/realms/camunda-platform/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=zeebe" \
  -d "client_secret=pwd-here"

!!! Note: If you see an error instead of access token, then perhaps you can debug to see what could be the mistake.

Hint: Sign In to Keycloak Admin Console and check the list of Clients configured. Can you see the mismatch?

View the token using jwt.io website.
Can you identify the subject (sub) claim in the token?
Specifically, where is this (sub) value coming from?

Show Answer

Answer: The subject (`sub`) claim comes from the service account or client credential used to request the token. In this case, the token is generated for the `zeebe` client, so the subject reflects the authenticated client identity.
In short, the "sub" value comes from the corresponding database record "id" attribute.


# !!! Important: Connecting to terminal session is only allowed during Live or In-Person sessions.
#
#
# Open new terminal session with postGRE sql pod and run below commands.
#
# Connect to the Database
psql -U bn_keycloak -d bitnami_keycloak
# Use the password from the K8S Secrets
# Run the sql query
SELECT * FROM public.user_entity WHERE id = 'value-of-sub-from-token';

Q. In the helm install step for Camunda, the release number is sent as a parameter (Example: 12.4.0 or 14.4.1).

In real-life scenario, if you are given an existing Kubernetes environment, how would you find out the Camunda release number?
Hint: Use Headlamp Dashboard or Project Lens UI app to look for the deployed helm charts (ConfigMap).

Show Answer

Q. Assume that a Deployment component (say Connectors) is deleted from the runtime.

How do you re-deploy the missing "Connectors" component?

Hint: Run this step Camunda 5-3 again, but with "helm upgrade" (instead of "helm insall").

Q. The elasticsearch pod running in your respective namespace, is it running on http plaintext port or tls?

Hint: Use kubectl or Headlamp Dashboard or Project Lens UI app.

Q. In lab 9a-1, while looking at Keycloak Admin Console, you may have noticed two realm configurations. One of them is for camunda-platform.

Who created (i.e., which step / component) the realm camunda-platform? (taking into account all the steps you executed so far)

Hint: Have you noticed any pattern when the pods are starting? Read a bit on Camunda Docs to understand the component dependency.

Q. If you sign-in to Management Identity from Landing Page (/identity), you may have trouble getting in. Can you debug this error?


kubectl annotate ingress \
  ${UNAMESPACE}-ingress \
  -n ${UNAMESPACE} \
  nginx.ingress.kubernetes.io/proxy-buffer-size="128k" \
  --overwrite

kubectl annotate ingress \
  ${UNAMESPACE}-ingress-keycloak \
  -n ${UNAMESPACE} \
  nginx.ingress.kubernetes.io/proxy-buffer-size="128k" \
  --overwrite

kubectl describe ingress ${UNAMESPACE}-camunda-platform-grpc -n ${UNAMESPACE}

kubectl describe ingress ${UNAMESPACE}-ingress -n ${UNAMESPACE}

kubectl describe ingress ${UNAMESPACE}-ingress-keycloak -n ${UNAMESPACE}

Lab Exercise #a