Create the first SeekrFlow administrator

A new deployment has no accounts. Create the first administrator, who owns your organization.

Don’t sign in to SeekrFlow until you finish this page. The first account to exist closes the step that creates an administrator. If someone signs in first, sfe org setup can recover with --recover-admin, but it’s simpler to avoid.

With the sfe CLI
Without the sfe CLI

sfe creates the administrator, the organization, and a break-glass administrator: a password account for signing in when single sign-on is unavailable. It names the organization from Auth.organization.name in your values file.

Preview the setup

Replace <admin-email> with the administrator’s address, and <break-glass-email> with a different address in your organization’s domain. Without single sign-on, include --skip-realm:

sfe org setup --admin <admin-email> --break-glass <break-glass-email> --skip-realm -p <profile-name> -r <version> --dry-run

The command reports what it would create, and changes nothing. If you leave out --break-glass, it uses breakglass@seekr.com.

Create the administrator

Run the same command with --yes instead of --dry-run:

sfe org setup --admin <admin-email> --break-glass <break-glass-email> --skip-realm -p <profile-name> -r <version> --yes

sfe asks for the administrator’s password, which must be at least 8 characters. It runs the setup as a job inside the cluster. You don’t need the Domain Name System (DNS) record yet.

Store the two credentials

sfe prints two values once:

Admin token – Lets sfe act as the administrator. It expires after 7 days. Before then, replace it with sfe org token rotate.
Break-glass password – The password for the break-glass administrator. Never sign in to the UI through single sign-on with the break-glass address, which ends its password.

Store both in your password manager or secret store before you continue. You can’t display them again.

Create the administrator with the Auth service’s bootstrap endpoint. It’s reachable only from inside the cluster, and it closes after the first account exists. Replace <admin-email> and <password> with the administrator’s address and password:

kubectl run bootstrap --rm -it --restart=Never --namespace seekrflow \
  --image=curlimages/curl -- \
  curl http://seekrflow-auth.seekrflow.svc.cluster.local:8003/v1/internal/auth/bootstrap \
  -H 'Content-Type: application/json' \
  -d '{"email": "<admin-email>", "password": "<password>"}'

A 200 response means the endpoint created the administrator. A 409 response means an account already exists. The endpoint creates the administrator only. It doesn’t create a break-glass administrator or set the organization’s name.

SeekrFlow Self-Managed

Plan a SeekrFlow deployment

Provision SeekrFlow dependencies

Prepare to install SeekrFlow

Deploy SeekrFlow

Operate SeekrFlow

Reference

Create the first SeekrFlow administrator