VM deployment for facilitator services

[rslangl]

Facilitator services include:

• IdP (FreeIPA)
• Workload identities (SPIRE)
• Secrets management (Vault)
• Certificate management (step-ca or Vault PKI engine)

FreeIPA and SPIRE server should be deployed to VM following Vault deployment. In k8s, deploy keycloak and SPIRE agents. Use, with a provided pre-provisioned intermediare cert, prior to installing k8s.

Prefer tools that store state, e.g. Terraform, for provisioning:

• keycloak terraform provider
• docker terraform provider
• vault terraform provider