Deployment and Operation
Edge authorizers can be deployed in various ways based on the application and target environment needs and requirements. In its most basic form, an authorizer is a Docker container instance, which can be deployed as a standalone service, sidecar, or development workstation.
An edge authorizer always operates in the context of a (single) Aserto organization and is assigned a specific policy instance to serve. This information is provided to the edge authorizer via a configuration file, which it uses to send a discovery call to the Aserto control plane.
Edge Authorizer Flavors
A couple of flavors of edge authorizers are available:
- Onebox: a single-tenant, single policy authorizer with a built-in web UI, to be used as a developer workstation.
- Sidecar: a single-tenant, single policy authorizer without a web UI. The sidecar is the general edge authorizer flavor with a small surface area, which can be used as a sidecar but also as a local service instance.
Docker images
Flavor | Image |
---|---|
Onebox | docker pull ghcr.io/aserto-dev/authorizer-onebox:latest |
Sidecar | docker pull ghcr.io/aserto-dev/authorizer-sidecar:latest |
Running the Edge Authorizer
You can run the Onebox authorizer using aserto
CLI. First, you need to configure your Onebox instance by running the following command:
aserto developer configure <POLICY_INSTANCE_NAME>
Then, start the Onebox instance by running:
aserto developer start <POLICY_INSTANCE_NAME>
Or by using the docker
CLI selecting the correct image (ghcr.io/aserto-dev/authorizer-sidecar:latest
or
ghcr.io/aserto-dev/authorizer-onebox:latest
):
#!/usr/bin/env bash
docker run \
-ti \
--rm \
--name aserto-one \
--platform=linux/amd64 \
-p 8282:8282 \
-p 8383:8383 \
-p 8484:8484 \
-v $PWD/certs:/certs:rw \
-v $PWD/cfg:/app/cfg:ro \
-v $PWD/eds:/app/db:rw \
ghcr.io/aserto-dev/authorizer-sidecar:latest run \
--config-file /app/cfg/config.yaml