Skip to content

Commit 1cc76ba

Browse files
bradymillerbradymiller
committed
Kubernete: Support for tls/x509 redis session connections
1 parent b3f9f0a commit 1cc76ba

14 files changed

Lines changed: 253 additions & 23 deletions

‎kubernetes/certs/redis-openemr-client.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redis-openemr-client
5+
spec:
6+
secretName: redis-openemr-client-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- client auth
18+
subject:
19+
organizations:
20+
- openemr
21+
commonName: openemr
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/certs/redis.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redis
5+
spec:
6+
secretName: redis-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
subject:
19+
organizations:
20+
- redis
21+
commonName: redis
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/certs/redisproxy.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redisproxy
5+
spec:
6+
secretName: redisproxy-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
subject:
19+
organizations:
20+
- redisproxy
21+
commonName: redisproxy
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/certs/sentinel.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: sentinel
5+
spec:
6+
secretName: sentinel-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
subject:
19+
organizations:
20+
- sentinel
21+
commonName: sentinel
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/kub-down‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ kubectl delete \
99
-f certs/mysql-openemr-client.yaml \
1010
-f certs/phpmyadmin.yaml \
1111
-f certs/mysql-phpmyadmin-client.yaml
12+
-f certs/redis.yaml \
13+
-f certs/redis-openemr-client.yaml \
14+
-f certs/sentinel.yaml \
15+
-f certs/redisproxy.yaml
1216

1317
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
1418

@@ -34,4 +38,4 @@ kubectl delete \
3438
-f volumes/website.yaml \
3539
-f openemr/secret.yaml \
3640
-f openemr/deployment.yaml \
37-
-f openemr/service.yaml
41+
-f openemr/service.yaml

‎kubernetes/kub-down.bat‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@ kubectl delete ^
99
-f certs/mysql-openemr-client.yaml ^
1010
-f certs/phpmyadmin.yaml ^
1111
-f certs/mysql-phpmyadmin-client.yaml
12+
-f certs/redis.yaml ^
13+
-f certs/redis-openemr-client.yaml ^
14+
-f certs/sentinel.yaml ^
15+
-f certs/redisproxy.yaml
1216

1317
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
1418

‎kubernetes/kub-up‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@ kubectl apply \
1414
-f certs/mysql-openemr-client.yaml \
1515
-f certs/phpmyadmin.yaml \
1616
-f certs/mysql-phpmyadmin-client.yaml
17+
-f certs/redis.yaml \
18+
-f certs/redis-openemr-client.yaml \
19+
-f certs/sentinel.yaml \
20+
-f certs/redisproxy.yaml
1721
echo "...waiting 15 seconds to ensure certs are created..."
1822
sleep 15
1923

@@ -39,4 +43,4 @@ kubectl apply \
3943
-f volumes/website.yaml \
4044
-f openemr/secret.yaml \
4145
-f openemr/deployment.yaml \
42-
-f openemr/service.yaml
46+
-f openemr/service.yaml

‎kubernetes/kub-up.bat‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,10 @@ kubectl apply ^
1212
-f certs/mysql-openemr-client.yaml ^
1313
-f certs/phpmyadmin.yaml ^
1414
-f certs/mysql-phpmyadmin-client.yaml
15+
-f certs/redis.yaml ^
16+
-f certs/redis-openemr-client.yaml ^
17+
-f certs/sentinel.yaml ^
18+
-f certs/redisproxy.yaml
1519
timeout 15
1620

1721
kubectl apply ^

‎kubernetes/openemr/deployment.yaml‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,16 +47,22 @@ spec:
4747
- name: OE_USER
4848
value: "admin"
4949
- name: REDIS_SERVER
50-
value: "redisproxy"
50+
# TODO - change below back to redisproxy after get the proxy working
51+
value: "redis"
5152
- name: REDIS_PASSWORD
5253
value: "defaultpassword"
54+
- name: REDIS_TLS
55+
value: "yes"
56+
# uncomment below if using redis x509
57+
#- name: REDIS_X509
58+
# value: "yes"
5359
- name: SWARM_MODE
5460
value: "yes"
5561
- name: FORCE_DATABASE_SSL_CONNECT
5662
# uncomment below line (and comment above line) if forcing mysql x509
5763
#- name: FORCE_DATABASE_X509_CONNECT
5864
value: "1"
59-
image: openemr/openemr:7.0.0
65+
image: openemr/openemr:7.0.1
6066
name: openemr
6167
ports:
6268
- containerPort: 80
@@ -68,6 +74,8 @@ spec:
6874
volumeMounts:
6975
- mountPath: /root/certs/mysql/server
7076
name: mysql-openemr-client-certs
77+
- mountPath: /root/certs/redis
78+
name: redis-openemr-client-certs
7179
- mountPath: /var/www/localhost/htdocs/openemr/sites
7280
name: websitevolume
7381
- mountPath: /etc/ssl
@@ -87,6 +95,17 @@ spec:
8795
# path: mysql-cert
8896
#- key: tls.key
8997
# path: mysql-key
98+
- name: redis-openemr-client-certs
99+
secret:
100+
secretName: redis-openemr-client-certs
101+
items:
102+
- key: ca.crt
103+
path: redis-ca
104+
# uncomment below if using redis x509
105+
#- key: tls.crt
106+
# path: redis-cert
107+
#- key: tls.key
108+
# path: redis-key
90109
- name: websitevolume
91110
persistentVolumeClaim:
92111
claimName: websitevolume

‎kubernetes/redis/configmap-main.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,17 @@ data:
2727
# this is the second ConfigMap will be mounted to. it has the list of users needed.
2828
aclfile /conf/acl/users.acl
2929
30-
# port, each redis nodes will be used
31-
port 6379
30+
# tls certs and setting
31+
tls-cert-file /certs/tls.crt
32+
tls-key-file /certs/tls.key
33+
tls-ca-cert-file /certs/ca.crt
34+
tls-auth-clients no
35+
# uncomment below (and comment line above) if using redis x509
36+
# tls-auth-clients yes
37+
tls-replication yes
38+
39+
# port, each redis nodes will be used (only use tls)
40+
port 0
41+
tls-port 6379
3242
# More configurations are optional, if not provided, redis will consider default values ------
3343
# ------ More details on configuration : https://redis.io/docs/manual/config/ ------

0 commit comments

Comments
 (0)