Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Expose liberty's support for generating a keyStore / trustStore from pem certs #59

Open
lmsurpre opened this issue Nov 5, 2021 · 2 comments

Comments

@lmsurpre
Copy link
Collaborator

lmsurpre commented Nov 5, 2021

In #58 we add support for handing the IBM FHIR Server a keystore / truststore.
However, its kind of a pain to create those and upload them to kubernetes secrets.

What might be nice is to expose Liberty's support for generating keystores by either:
A. mounting a secret that has tls.key, tls.crt, and ca.crt to TLS_DIR (/etc/x509/certs/); or
B. setting SEC_IMPORT_K8S_CERTS to true so that the .crt files under /var/run/secrets/kubernetes.io/serviceaccount will be imported into the truststore file

The only documentation I've found for these features is at https://github.com/OpenLiberty/ci.docker/blob/master/SECURITY.md#providing-custom-certificates-20003

What would be nice is if we could easily support establishing TLS between the IBM FHIR Server and a postgresql server from its subchart (and keycloak too?).

@lmsurpre
Copy link
Collaborator Author

lmsurpre commented Nov 5, 2021

As a single datapoint, on IBM Cloud Kubernetes Service (IKS), the cluster cert also uses keys tls.key and tls.crt.
Not clear if that is universal in kubernetes or not.
The bitnami postgresql subchart uses cert.crt, cert.key, and ca.crt instead.

@chgl
Copy link
Collaborator

chgl commented Nov 6, 2021

To add a datapoint: tls.key and tls.cert are also used by secrets of type TLS (https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets).

I generelly think if TLS between many services is desirable, mTLS via a service mesh may be less complex to setup.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants