🖥️ shellno session yet

Chapter 2 — Stack and sign-in

One command brings up everything

make dev

Builds every image, creates a kind cluster, applies the dev overlay, waits for readiness, and seeds the demo world.

==> plexsphere dev stack is up
    API ready:  http://localhost:8080/readyz
    Dex OIDC:   http://localhost:5556/dex/.well-known/openid-configuration

Presenter note: run this before the room fills. On a cold image cache it is minutes of build output. Show the command, show the finished banner.

Build the CLI

make dev brings up the platform. The operator CLI is a separate build — put it on $PATH and point it at the local API:

make plexctl-build
export PATH="$PWD/bin:$PATH"
export PLEXSPHERE_URL=http://localhost:8080
plexctl --version

version=f0206ae4 commit=f0206ae4 date=2026-07-31T18:00:57Z

This is the only shell preamble in the whole demo. Every later chapter inherits it.

Read the Domain id off the stack

Signing in needs the Domain's UUID, and there is a chicken-and-egg problem: you cannot read it through the authenticated API before you hold a token. So it comes straight out of the seeded database.

eval "$(make -s dev-ids)"
echo "domain=$DOMAIN_ID"

domain=019ed19b-68dc-7aa9-8995-80e810444cce

This is the only time the demo reaches past the API. Everything after this is an authenticated /v1 call.

🛡️ adminadmin@example.com · Domain admin in Acme Corp

Sign in

plexctl login --domain-id "$DOMAIN_ID"

To complete sign-in, visit:
  http://localhost:8080/v1/device?user_code=VFOLL2SZ

The device-code flow. The CLI blocks and polls; you approve in a browser as admin@example.com / password.

The control plane serves the approval page itself — this local stack needs no external dashboard.

Presenter note: the code differs every run. Open the printed link, do not type the code.

Who does it think you are

plexctl whoami

PRINCIPAL  SCOPE   SUBJECT                               DOMAIN                                ACR  AMR
user       domain  019ecc65-9f3a-7c14-8d2b-5f3e0a7b1c40  019ecc65-8622-7a7f-bfe1-0344c7a22dbd  -    -

Read the SCOPE column: domain.

Identity in plexsphere is per-Domain. This principal exists in Acme Corp and nowhere else. The same human signing into Beta LLC gets a different subject UUID and a different principal — which is exactly what chapter 3 shows.

What we now have

A control plane on localhost:8080, seeded with four Domains.

A CLI on $PATH, holding a token for one principal in one Domain.

A token that lives one hour — chapter 9 has a re-authentication slide for when it runs out.

Everything from here is an authenticated API call.