Skip to content

Commit c18ddf9

Browse files
bradymillerbradymiller
committed
Kubernete: Support for tls/x509 redis session connections
1 parent 45818e8 commit c18ddf9

19 files changed

+308
-151
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ See our [product comparison](https://www.open-emr.org/wiki/index.php/AWS_Cloud_P
3030
* [OpenEMR Monitor](utilities/openemr-monitor): OpenEMR Monitor is based on Prometheus, cAdvisor, Grafana, and alertmanger which helps administrator to monitor the status of containers
3131
* [Portainer](utilities/portainer): Portainer is a lightweight management UI which allows you to easily manage your different Docker environments (Docker hosts)
3232
* [OpenEMR Environment Migrator](utilities/openemr-env-migrator): OpenEMR Environment Migrator is used to migrate your container environment to the new storage directory or the remote host easily
33-
* [OpenEMR Kubernetes Orchestrations](kubernetes): OpenEMR Kubernetes orchestration on Minikube. Creates 2 instances of OpenEMR with 1 instance of MariaDB, Redis, and phpMyAdmin.
33+
* [OpenEMR Kubernetes Orchestrations](kubernetes): OpenEMR Kubernetes orchestration.
3434

3535
### Community Contributions
3636

‎kubernetes/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
OpenEMR Kubernetes orchestration. Orchestration included OpenEMR, MariaDB, Redis, and phpMyAdmin.
33
- OpenEMR - 3 deployment replications of OpenEMR are created. Replications can be increased/decreased. Ports for both http and https.
44
- MariaDB - 2 statefulset replications of MariaDB (1 primary/master with 1 replica/slave) are created. Replications can be increased/decreased which will increase/decrease number of replica/slaves. Connections are encrypted over the wire (ssl is enforced by default; X509 can be enforced by following pertinent comments in following scripts: 2 places in mysql/configmap.yaml, 2 places in openemr/deployment.yaml, 1 place in phpmyadmin/configmap.yaml, 1 place in phpmyadmin/deployment.yaml).
5-
- Redis - Configured to support failover. There is 1 master and 2 slaves (no read access on slaves) for a statefulset, 3 sentinels for another statefulset, and then 2 proxies deployment. The proxies ensure that redis traffic is always directed towards master. The proxy replications can be increased/decreased. However the primary/slaves and sentinels would require script changes if wish to increase/decrease replicates for these since these are hard-coded several place in the scripts. There are 3 users/passwords (`default` (defaultpassword), `replication` (replicationpassword), `admin` (adminpassword)) used in this redis scheme, and the passwords should be set to something else if use this scheme in production. The main place the passwords are set is in kubernetes/redis/configmap-acl.yaml script. Other places where passwords are used include the following: `replication` in kubernetes/redis/configmap-main.yaml, `admin` in kubernetes/redis/configmap-pipy.yaml, `admin` in kubernetes/redis/statefulset-sentinel.yaml. The `default` is the typical worker/app/client user.
5+
- Redis - Configured to support failover. There is 1 master and 2 slaves (no read access on slaves) for a statefulset, 3 sentinels for another statefulset, and then 2 proxies deployment. The proxies ensure that redis traffic is always directed towards master. The proxy replications can be increased/decreased. However the primary/slaves and sentinels would require script changes if wish to increase/decrease replicates for these since these are hard-coded several place in the scripts. There are 3 users/passwords (`default` (defaultpassword), `replication` (replicationpassword), `admin` (adminpassword)) used in this redis scheme, and the passwords should be set to something else if use this scheme in production. The main place the passwords are set is in redis/configmap-acl.yaml script. Other places where passwords are used include the following: `replication` in redis/configmap-main.yaml, `admin` in redis/configmap-pipy.yaml, `admin` in redis/statefulset-sentinel.yaml, `admin` in redis/healthcheck-haproxy.yaml. The `default` is the typical worker/app/client user. Connections are encrypted over the wire (ssl is enforced by default; X509 can be enforced by following pertinent comments in following scripts: 2 places in openemr/deployment.yaml, 1 place in redis/configmap-main.yaml, 1 place in redis/healthcheck-haproxy.yaml, 1 place in redis/statefulset-redis.yaml, 2 places in redis/statefulset-sentinel.yaml).
66
- phpMyAdmin - There is 1 deployment instance of phpMyAdmin. Ports for both http and https.
77

88
Would not consider this production quality, but will be a good working, starting point, and hopefully open the door to a myriad of other kubernetes based solutions. Note this is supported by 7.0.0 and higher dockers. If wish to use the most recent development codebase, then can change from openemr/openemr:7.0.1 to openemr/openemr:dev (in the openemr/deployment.yaml script), which is built nightly from the development codebase. If you wish to build dynamically from a branch/tag from a github repo or other git repo, then can change from openemr/openemr:7.0.1 to openemr/openemr:flex (in the openemr/deployment.yaml script) (note this will take much longer to start up (probably at least 10 minutes and up to 90 minutes) and is more cpu intensive since each instance of OpenEMR will download codebase and build separately).

‎kubernetes/certs/redis-openemr-client.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redis-openemr-client
5+
spec:
6+
secretName: redis-openemr-client-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- client auth
18+
subject:
19+
organizations:
20+
- openemr
21+
commonName: openemr
22+
issuerRef:
23+
name: ca-issuer
24+
kind: Issuer
25+
group: cert-manager.io

‎kubernetes/certs/redis.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redis
5+
spec:
6+
secretName: redis-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
- client auth
19+
subject:
20+
organizations:
21+
- redis
22+
commonName: redis
23+
dnsNames:
24+
- redisproxy
25+
- redis-0.redis
26+
- redis-1.redis
27+
- redis-2.redis
28+
issuerRef:
29+
name: ca-issuer
30+
kind: Issuer
31+
group: cert-manager.io

‎kubernetes/certs/redisproxy.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: redisproxy
5+
spec:
6+
secretName: redisproxy-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
- client auth
19+
subject:
20+
organizations:
21+
- redisproxy
22+
commonName: redisproxy
23+
issuerRef:
24+
name: ca-issuer
25+
kind: Issuer
26+
group: cert-manager.io

‎kubernetes/certs/sentinel.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: sentinel
5+
spec:
6+
secretName: sentinel-certs
7+
duration: 87660h # 10y
8+
renewBefore: 360h # 15d
9+
isCA: false
10+
privateKey:
11+
size: 2048
12+
algorithm: RSA
13+
encoding: PKCS1
14+
usages:
15+
- digital signature
16+
- key encipherment
17+
- server auth
18+
- client auth
19+
subject:
20+
organizations:
21+
- sentinel
22+
commonName: sentinel
23+
issuerRef:
24+
name: ca-issuer
25+
kind: Issuer
26+
group: cert-manager.io

‎kubernetes/custom-dockers/haproxy-28-redis-tools/Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
FROM haproxy:2.8
2+
USER root
3+
RUN apt-get update && apt-get install -y --no-install-recommends redis-tools
4+
USER haproxy

‎kubernetes/kub-down‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ kubectl delete \
88
-f certs/mysql-replication.yaml \
99
-f certs/mysql-openemr-client.yaml \
1010
-f certs/phpmyadmin.yaml \
11-
-f certs/mysql-phpmyadmin-client.yaml
11+
-f certs/mysql-phpmyadmin-client.yaml \
12+
-f certs/redis.yaml \
13+
-f certs/redis-openemr-client.yaml \
14+
-f certs/sentinel.yaml \
15+
-f certs/redisproxy.yaml
1216

1317
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
1418

@@ -19,7 +23,8 @@ kubectl delete \
1923
-f mysql/statefulset.yaml \
2024
-f redis/configmap-main.yaml \
2125
-f redis/configmap-acl.yaml \
22-
-f redis/configmap-pipy.yaml \
26+
-f redis/configmap-haproxy.yaml \
27+
-f redis/healthcheck-haproxy.yaml \
2328
-f redis/statefulset-redis.yaml \
2429
-f redis/statefulset-sentinel.yaml \
2530
-f redis/deployment-redisproxy.yaml \
@@ -34,4 +39,4 @@ kubectl delete \
3439
-f volumes/website.yaml \
3540
-f openemr/secret.yaml \
3641
-f openemr/deployment.yaml \
37-
-f openemr/service.yaml
42+
-f openemr/service.yaml

‎kubernetes/kub-down.bat‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,11 @@ kubectl delete ^
88
-f certs/mysql-replication.yaml ^
99
-f certs/mysql-openemr-client.yaml ^
1010
-f certs/phpmyadmin.yaml ^
11-
-f certs/mysql-phpmyadmin-client.yaml
11+
-f certs/mysql-phpmyadmin-client.yaml ^
12+
-f certs/redis.yaml ^
13+
-f certs/redis-openemr-client.yaml ^
14+
-f certs/sentinel.yaml ^
15+
-f certs/redisproxy.yaml
1216

1317
kubectl delete -f https://github.com/cert-manager/cert-manager/releases/download/v1.11.0/cert-manager.yaml
1418

@@ -19,7 +23,8 @@ kubectl delete ^
1923
-f mysql/statefulset.yaml ^
2024
-f redis/configmap-main.yaml ^
2125
-f redis/configmap-acl.yaml ^
22-
-f redis/configmap-pipy.yaml ^
26+
-f redis/configmap-haproxy.yaml ^
27+
-f redis/healthcheck-haproxy.yaml ^
2328
-f redis/statefulset-redis.yaml ^
2429
-f redis/statefulset-sentinel.yaml ^
2530
-f redis/deployment-redisproxy.yaml ^

‎kubernetes/kub-up‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,11 @@ kubectl apply \
1313
-f certs/mysql-replication.yaml \
1414
-f certs/mysql-openemr-client.yaml \
1515
-f certs/phpmyadmin.yaml \
16-
-f certs/mysql-phpmyadmin-client.yaml
16+
-f certs/mysql-phpmyadmin-client.yaml \
17+
-f certs/redis.yaml \
18+
-f certs/redis-openemr-client.yaml \
19+
-f certs/sentinel.yaml \
20+
-f certs/redisproxy.yaml
1721
echo "...waiting 15 seconds to ensure certs are created..."
1822
sleep 15
1923

@@ -24,7 +28,8 @@ kubectl apply \
2428
-f mysql/statefulset.yaml \
2529
-f redis/configmap-main.yaml \
2630
-f redis/configmap-acl.yaml \
27-
-f redis/configmap-pipy.yaml \
31+
-f redis/configmap-haproxy.yaml \
32+
-f redis/healthcheck-haproxy.yaml \
2833
-f redis/statefulset-redis.yaml \
2934
-f redis/statefulset-sentinel.yaml \
3035
-f redis/deployment-redisproxy.yaml \
@@ -39,4 +44,4 @@ kubectl apply \
3944
-f volumes/website.yaml \
4045
-f openemr/secret.yaml \
4146
-f openemr/deployment.yaml \
42-
-f openemr/service.yaml
47+
-f openemr/service.yaml

0 commit comments

Comments
 (0)