Skip to content

Commit 66f49f5

Browse files
bradymillerbradymiller
committed
Kubernete: Support for tls/x509 redis session connections
1 parent 8a11a89 commit 66f49f5

14 files changed

+251
-21
lines changed

‎kubernetes/certs/redis-openemr-client.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redis-openemr-client
5+
spec:
6+
secretName: redis-openemr-client-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- client auth
18+
subject:
19+
organizations:
20+
- openemr
21+
commonName: openemr
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/certs/redis.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redis
5+
spec:
6+
secretName: redis-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
subject:
19+
organizations:
20+
- redis
21+
commonName: redis
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/certs/redisproxy.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redisproxy
5+
spec:
6+
secretName: redisproxy-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
subject:
19+
organizations:
20+
- redisproxy
21+
commonName: redisproxy
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/certs/sentinel.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: sentinel
5+
spec:
6+
secretName: sentinel-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
subject:
19+
organizations:
20+
- sentinel
21+
commonName: sentinel
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/kub-down‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ kubectl delete \
55
-f certs/ca-certificate.yaml \
66
-f certs/ca-issuer.yaml \
77
-f certs/mysql.yaml \
8+
-f certs/redis.yaml \
9+
-f certs/redis-openemr-client.yaml \
10+
-f certs/sentinel.yaml \
11+
-f certs/redisproxy.yaml \
812
-f certs/phpmyadmin.yaml
913

1014
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml

‎kubernetes/kub-down.bat‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ kubectl delete ^
55
-f certs/ca-certificate.yaml ^
66
-f certs/ca-issuer.yaml ^
77
-f certs/mysql.yaml ^
8+
-f certs/redis.yaml ^
9+
-f certs/redis-openemr-client.yaml ^
10+
-f certs/sentinel.yaml ^
11+
-f certs/redisproxy.yaml ^
812
-f certs/phpmyadmin.yaml
913

1014
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml

‎kubernetes/kub-up‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ kubectl apply \
1010
-f certs/ca-certificate.yaml \
1111
-f certs/ca-issuer.yaml \
1212
-f certs/mysql.yaml \
13+
-f certs/redis.yaml \
14+
-f certs/redis-openemr-client.yaml \
15+
-f certs/sentinel.yaml \
16+
-f certs/redisproxy.yaml \
1317
-f certs/phpmyadmin.yaml
1418
echo "...waiting 15 seconds to ensure certs are created..."
1519
sleep 15

‎kubernetes/kub-up.bat‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ kubectl apply ^
88
-f certs/ca-certificate.yaml ^
99
-f certs/ca-issuer.yaml ^
1010
-f certs/mysql.yaml ^
11+
-f certs/redis.yaml ^
12+
-f certs/redis-openemr-client.yaml ^
13+
-f certs/sentinel.yaml ^
14+
-f certs/redisproxy.yaml ^
1115
-f certs/phpmyadmin.yaml
1216
timeout 15
1317

‎kubernetes/openemr/deployment.yaml‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,14 +47,20 @@ spec:
4747
- name: OE_USER
4848
value: "admin"
4949
- name: REDIS_SERVER
50-
value: "redisproxy"
50+
# TODO - change below back to redisproxy after get the proxy working
51+
value: "redis"
5152
- name: REDIS_PASSWORD
5253
value: "defaultpassword"
54+
- name: REDIS_TLS
55+
value: "yes"
56+
# uncomment below if using redis x509
57+
#- name: REDIS_X509
58+
# value: "yes"
5359
- name: SWARM_MODE
5460
value: "yes"
5561
- name: FORCE_DATABASE_SSL_CONNECT
5662
value: "1"
57-
image: openemr/openemr:7.0.0
63+
image: openemr/openemr:7.0.1
5864
name: openemr
5965
ports:
6066
- containerPort: 80
@@ -66,6 +72,8 @@ spec:
6672
volumeMounts:
6773
- mountPath: /root/certs/mysql/server
6874
name: mysql-server-certs
75+
- mountPath: /root/certs/redis
76+
name: redis-openemr-client-certs
6977
- mountPath: /var/www/localhost/htdocs/openemr/sites
7078
name: websitevolume
7179
- mountPath: /etc/ssl
@@ -80,6 +88,17 @@ spec:
8088
items:
8189
- key: ca.crt
8290
path: mysql-ca
91+
- name: redis-openemr-client-certs
92+
secret:
93+
secretName: redis-openemr-client-certs
94+
items:
95+
- key: ca.crt
96+
path: redis-ca
97+
# uncomment below if using redis x509
98+
#- key: tls.crt
99+
# path: redis-cert
100+
#- key: tls.key
101+
# path: redis-key
83102
- name: websitevolume
84103
persistentVolumeClaim:
85104
claimName: websitevolume

‎kubernetes/redis/configmap-main.yaml‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,17 @@ data:
2727
# this is the second ConfigMap will be mounted to. it has the list of users needed.
2828
aclfile /conf/acl/users.acl
2929
30-
# port, each redis nodes will be used
31-
port 6379
30+
# tls certs and setting
31+
tls-cert-file /certs/tls.crt
32+
tls-key-file /certs/tls.key
33+
tls-ca-cert-file /certs/ca.crt
34+
tls-auth-clients no
35+
# uncomment below (and comment line above) if using redis x509
36+
# tls-auth-clients yes
37+
tls-replication yes
38+
39+
# port, each redis nodes will be used (only use tls)
40+
port 0
41+
tls-port 6379
3242
# More configurations are optional, if not provided, redis will consider default values ------
3343
# ------ More details on configuration : https://redis.io/docs/manual/config/ ------

0 commit comments

Comments
 (0)