Persistant data storage for containers

[drjoms]

i can deploy docker and bootstrap EJBCA's CA.
I am not novice into PKI.

I deploy free EJBCA container into home lab.
And I was pleasantly surprised how easy it was.
One of reasons - Maria DB is part of a container.
Which is double edged sword. On one hand, batteries included, which just works.
On the other hand - we are looking at loss of state if VM where I deploy said pod goes down.
CRLs, info on existing certs.
So knee jerk reaction - automate committing container and NEVER update EJBCA.

And there is an alternative...
Use -v in container to outsource container's persistent data to OS. I imagine immedeatelly would go there:
software HSM that i will have to install in the pod, its DB of certs stored in. MariaDB, what else?

I would love to hear from Keyfactor rep, how do they see situation? And i don't mind hearing honest truth. My lab is exactly this - discard-able lab. I am not a small business IT guy who deployes EJBCA pod for sake of having PKI. its used for learning. and possible for learning how to implement Keyfactor's product in the future. I am NOT asking for support. Like i said. I deployed and bootstrapped before. CMP/ACME - I have had for breakfast before. Its matter of time i implement them with EJBCA. together with softHSM inside of a container.

I am curious about EJBCA containers from perspective of updates/persistence.
is there some documentation i missed?

[drjoms]

i am guessing this is addressing my questions:
https://docs.keyfactor.com/how-to/latest/start-out-with-ejbca-docker-container

persistent DB could be all that is needed.

as long as DB schemas don't change.

[primetomas]

That is a good tutorial yes.

The container does not have a MariaDB built in, a quick start uses the built in WildFly database, H2, which is in-memory.

The DockerHub container documentation have a section about "Using an external database", https://hub.docker.com/r/keyfactor/ejbca-ce
You also have docker-compose examples here under deployment-examples. https://github.com/Keyfactor/keyfactorcommunity

[drjoms]

said document, has yaml file in it.

dimko@CA:$ podman container list
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
f4103807b48d docker.io/library/mariadb:latest mariadbd 5 minutes ago Up 5 minutes 3306/tcp ejbca-database
d85d14880e2f docker.io/keyfactor/ejbca-ce:latest /opt/keyfactor/bi... 5 minutes ago Up 5 minutes 0.0.0.0:80->8080/tcp, 0.0.0.0:443->8443/tcp, 7600/tcp, 8009/tcp, 8081-8082/tcp, 57600/tcp ejbca
dimko@CA:$ cd containers/
dimko@CA:/containers$ ls
datadbdir docker-compose.yml ejbca_data
dimko@CA:/containers$ cat docker-compose.yml
networks:
access-bridge:
driver: bridge
application-bridge:
driver: bridge
services:
ejbca-database:
container_name: ejbca-database
image: "library/mariadb:latest"
networks:
- application-bridge
environment:
- MYSQL_ROOT_PASSWORD=foo123
- MYSQL_DATABASE=ejbca
- MYSQL_USER=ejbca
- MYSQL_PASSWORD=ejbca
volumes:
- ./datadbdir:/var/lib/mysql:Z

i followed instructions, now i have persistent ejbca container instance, which is cool as hell! I still mantain my position, it has MariaDB :D

i already have found problems, which i will report :D Nothing serious, not security compromising.
(I used to be support, practically a QA, for PKI software, so you get free QA there!)

can't wait otherwise to automate lab with some auto issuance to kubernetes containers over ACME or whatever :D
thanks for the opportunity!

[primetomas]

Make sure to check out the EJBCA cert-manager issuer. https://github.com/Keyfactor/ejbca-cert-manager-issuer

[drjoms]

Oh whooa, thanks!
curl seems like an option now as PKI client!
this does make life easier.