You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In #58 we add support for handing the IBM FHIR Server a keystore / truststore.
However, its kind of a pain to create those and upload them to kubernetes secrets.
What might be nice is to expose Liberty's support for generating keystores by either:
A. mounting a secret that has tls.key, tls.crt, and ca.crt to TLS_DIR (/etc/x509/certs/); or
B. setting SEC_IMPORT_K8S_CERTS to true so that the .crt files under /var/run/secrets/kubernetes.io/serviceaccount will be imported into the truststore file
What would be nice is if we could easily support establishing TLS between the IBM FHIR Server and a postgresql server from its subchart (and keycloak too?).
The text was updated successfully, but these errors were encountered:
As a single datapoint, on IBM Cloud Kubernetes Service (IKS), the cluster cert also uses keys tls.key and tls.crt.
Not clear if that is universal in kubernetes or not.
The bitnami postgresql subchart uses cert.crt, cert.key, and ca.crt instead.
In #58 we add support for handing the IBM FHIR Server a keystore / truststore.
However, its kind of a pain to create those and upload them to kubernetes secrets.
What might be nice is to expose Liberty's support for generating keystores by either:
A. mounting a secret that has
tls.key
,tls.crt
, andca.crt
to TLS_DIR (/etc/x509/certs/
); orB. setting SEC_IMPORT_K8S_CERTS to true so that the
.crt
files under/var/run/secrets/kubernetes.io/serviceaccount
will be imported into the truststore fileThe only documentation I've found for these features is at https://github.com/OpenLiberty/ci.docker/blob/master/SECURITY.md#providing-custom-certificates-20003
What would be nice is if we could easily support establishing TLS between the IBM FHIR Server and a postgresql server from its subchart (and keycloak too?).
The text was updated successfully, but these errors were encountered: