How to migrate a 'classic' ejbca instance to docker

[kuehne-trustable-de]

As the 'Issues' on the docker project 'https://github.com/Keyfactor/ejbca-containers' is not available I do ask my question here:

We are happily running an ejbca instance and want to migrate to docker. Simply reusing the existing database fails as I don't see any option to set the encryption key (once defined in cesecore.properties). Am I mssing something obvious?

[primetomas]

I think you are looking for the parameters that we recently added to the container. Look under security parameters at https://hub.docker.com/r/keyfactor/ejbca-ce.

Would be glad to hear how it goes, let us know.

[kuehne-trustable-de]

Sorry, could not verify the effect of the mentioned parameter. Once starting with a pre-filled database the jboss start fails with

ejbca 15:25:52.30 INFO ==> Creating database tables and indexes
ERROR 1050 (42S01) at line 1: Table 'AccessRulesData' already exists

What's required to tell the server that the existing database is fine to use?

[primetomas]

Hmm, I don't see that message in the code. Are you running the latest version? Otherwise I'm looking at the wrong code perhaps.
Do you see a message like this first: "Waiting for external database '${DATABASE_JDBC_URL}' to become available"

What parameters do you use to start the container?

[primetomas]

If DATABASE_JDBC_URL is set, and not containing "h2" it looks for an external database, and makes a test query like:
SELECT rowVersion FROM GlobalConfigurationData WHERE configurationId='UPGRADE';

[kuehne-trustable-de]

We are using the bitnami wrapper to have the ejbca embedded in the k8s context. I'm assuming that thre are no relevant changes done by bitnami to the given keyfactor docker image.
The full log of the start follows:

ejbca 17:25:26.72 INFO ==> ** Starting ejbca setup **
ejbca 17:25:26.73 WARN ==> Skipping export of 'EJBCA_WILDFLY_ADMIN_PASSWORD'. '/opt/bitnami/wildfly/tmp/wildfly_admin.pwd' is not readable.
ejbca 17:25:26.74 INFO ==> Validating settings in EJBCA_* env vars...
ejbca 17:25:26.74 INFO ==> Initializing EJBCA...
ejbca 17:25:26.75 INFO ==> Deploying EJBCA from scratch
ejbca 17:25:26.77 INFO ==> Creating database tables and indexes
ERROR 1050 (42S01) at line 1: Table 'AccessRulesData' already exists

Do these messages come from bitnami-added scripts?

[primetomas]

What wrapper is that, can you send a link? As far as I know bitnami created their own container, so yes I would assume it's all their stuff.

We are running the official container in k8s environments, including public cloud's container runtimes.

[kuehne-trustable-de]

For convenience reasons we try to prefer the helm charts provided b bitnami (https://bitnami.com/stack/ejbca/helm).
This refers to the bitnami-build docker image for the ejbca.
I wouldn't expect that they don't start to interfere with the database schema maagement.

[primetomas]

The messages show that they have done their own code/scripts. As we have nothing to do with that you need to ask them.

[kuehne-trustable-de]

Oh yes, now I see!
Do you got a helm script for the ejbca at hand?

[primetomas]

Here is stuff for EJBCA.
https://github.com/Keyfactor?q=ejbca&type=all&language=&sort=

I see helm charts, but it's private as of now. I'll ask when it's planned to make public.

[primetomas]

Ok, it's planned to be public, but still needs some work and improvements. Unfortunately I can't get an ETA at the moment.

[primetomas]

Actually here are helm charts used for demo at our tech meetup that we had lat year in Stockholm.
https://github.com/Keyfactor/ejbca-ce-helm-meetup

[primetomas]

You can find updated helm charts here:
https://github.com/Keyfactor/ejbca-community-helm