Kubernetes Installation

CREATE USER ers LOGIN PASSWORD 'changeit' ;
CREATE DATABASE clm with owner = 'ers' ;
CREATE DATABASE keycloak with owner = 'ers' ;
CREATE DATABASE cara with owner = 'ers' ;
CREATE DATABASE acme with owner = 'ers' ;

CREATE USER ers@'%' IDENTIFIED BY 'changeit' ;
CREATE USER ers@localhost IDENTIFIED BY 'changeit' ;
GRANT ALL PRIVILEGES ON *.* TO 'ers'@'%'; flush privileges ;
CREATE DATABASE cara CHARACTER SET = 'utf8' COLLATE = 'utf8_unicode_ci';
CREATE DATABASE clm CHARACTER SET = 'utf8' COLLATE = 'utf8_unicode_ci';
CREATE DATABASE keycloak CHARACTER SET = 'utf8' COLLATE = 'utf8_unicode_ci';
CREATE DATABASE acme CHARACTER SET = 'utf8' COLLATE = 'utf8_unicode_ci';

kubectl create namespace ers

kubectl create secret docker-registry regcred --namespace mtg  --docker-server=https://repo.mtg.de/ --docker-username="Repo_1234" --docker-password="Repo_password"

helm repo add mtg-repo https://Repo_1234:Repo_password@repo.mtg.de/repository/helm/

helm repo update

ingress:
  className: "nginx"
  ers:
    host: "erstest.example.com"
  cara:
    host: "erstest.example.com"
  ocsp:
    host: "erstest.example.com"
  crl:
    host: "erstest.example.com"
ers:
  db:
    hosts: "192.0.2.189:3306"
    type: "mariadb"
    caradb:
      name: "cara"
      username: "ers"
      password: "changeit"
    clmdb:
      name: "clm"
      username: "ers"
      password: "changeit"
    keycloakdb:
      name: "keycloak"
      username: "ers"
      password: "changeit"
    acmedb:
      name: "acme"
      username: "ers"
      password: "changeit"
  defaultPki:
    common:
      organization: "MTG AG"
      organizationalUnit: "Default"
      country: "DE"
    rootCa:
      commonName: "Default Root CA"
      validityInYears: "30"
      keyAlgorithm: "RSA"
      keyParameter: "4096"
      signatureAlgorithm: "SHA384withRSA"
    subCa:
      commonName: "Default Sub CA"
      validityInYears: "25"
      keyAlgorithm: "RSA"
      keyParameter: "4096"
      signatureAlgorithm: "SHA384withRSA"
    managementRootCa:
      commonName: "Default Management RA Root"
      validityInYears: "15"
      keyAlgorithm: "RSA"
      keyParameter: "4096"
      signatureAlgorithm: "SHA384withRSA"
    managementAdminUser:
      firstName: "Devops"
      lastName: "Devops"
      password: "changeit"
      email: "devops@mtg.de"
      p12Password: "changeit"
  keycloakAdminUser:
    username: "kadmin"
    password: "kadminpassword"
  clmClients:
    estServer:
      enabled: true
    cmpServer:
      enabled: true
    scepServer:
      enabled: true
    acmeServer:
      enabled: true

kubectl get ingressclasses.networking.k8s.io

helm upgrade --install --create-namespace --namespace mtg test mtg-repo/ers -f /path/to/values.yaml

kubectl get secrets --namespace mtg -o jsonpath='{ .data.management-user }' test-management-user   | base64 --decode  > test-management-user.p12

ws:
  extraVolumes:
    - name: lib
       emptyDir: {}
  extraVolumeMounts:
    - mountPath: "/home/mtg"
      name: lib
      readOnly: true
  extraInitContainers:
    - name: copy-hsm-lib-to-cara-ws-container
      image: "ubuntu:jammy"
      imagePullPolicy: IfNotPresent
      volumeMounts:
        - mountPath: "/home/mtg"
          name: lib
          readOnly: false
      command: ["/bin/sh"]
      args:
        - "-c"
        - |
          echo "Do here something to get the lib, then move it where you mounted the volume"
          cp lib.so /home/mtg/
          echo "Done!, init container completed, will start now cara-ws-server"

ws:
  extraVolumes:
    - name: host
       hostPath:
         path: "/data/foo"
         type: Directory
    - name: lib
       emptyDir: {}
  extraVolumeMounts:
    - mountPath: "/home/mtg"
      name: lib
      readOnly: true
  extraInitContainers:
    - name: copy-hsm-lib-to-cara-ws-container
      image: "ubuntu:jammy"
      imagePullPolicy: IfNotPresent
      volumeMounts:
        - mountPath: "/data/foo"
          name: host
          readOnly: true
        - mountPath: "/home/mtg"
          name: lib
          readOnly: false
      command: ["/bin/sh"]
      args:
        - "-c"
        - |
          cp /data/foo/lib.so /home/mtg/
          echo "Done!, init container completed, will start now cara-ws-server"

apiVersion: v1
kind: ConfigMap
metadata:
  name: hsm-config
  namespace: mtg
data:
    hsm.cfg: |
        content of a config file goes here
        more content goes here..
        ... etc

kubectl apply -f /path/to/configmap

ws:
  extraVolumes:
    - name: hsm-config-volume
      configMap:
        name: hsm-config
  extraVolumeMounts:
    - mountPath: "/tmp/config"
      name: hsm-config-volume
      readOnly: true

ws:
  extraEnvs:
    - name: CS_PKCS11_R3_CFG
      value: "/tmp/config/hsm.cfg"

ws:
    extraContainers
        - name: copy-hsm-lib-to-cara-ws-container
            image: "ubuntu:jammy"
            imagePullPolicy: IfNotPresent
            command: ["/bin/sh"]
            args:
              - "-c"
              - |
                echo "This container is running in parallel to cara-ws-server. Both share the same network namespace"
                tail -f /dev/null

kubectl taint node worker33 hsm=whatever:NoSchedule

kubectl get nodes -o jsonpath='{ .spec.taints }' worker55

ws:
  tolerations:
    - key: "hsm"
      operator: "Equal"
      value: "whatever"
      effect: "NoSchedule"

kubectl get nodes -o jsonpath='{ .metadata.labels }' worker55

ws:
  nodeSelector
    kubernetes.io/hostname:"worker55"

ws:
  affinity:
    nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
          - matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values:
              - worker33
              - worker44
        preferredDuringSchedulingIgnoredDuringExecution:
        - weight: 1
          preference:
            matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values:
              - worker33