How to change just DB IP in EJBCA 8.0 docker container

[merryo11]

Hi All, I am running a docker container with external mysql DB and need to change my DB IP for some security reasons so changing the IP of my db machine is straight forward but how can i change my running container IP defined in JDBC DB URL.

E.g. my DB ip is 10.20.1.10 and now I want to change it to 10.20.3.10 with disturbing my dongle settings and already running DB values.

Can anyone help??

Thanks

[primetomas]

The "container" way to do this is to treat containers as ephemeral instances. So what you do is to kill the old container and start a new one.
In a container environment this can be done transparently, you would have multiple EJBCA containers running, start a new one pointing to the new database IP, then you would configure your loadbalancer to direct traffic to the new container instances and shut down the old one.

The running containers are ephemeral and can be shut down and restarted at any time, new container instances started to handle increased load (which can be done automatically in a kubernetes cluster).

[merryo11]

Creating new instance from keyfactor/rjbca-ce image apply new management CA and superadmin which I don't want. What my requirement is to change my docker pointer from db1 to db2 without disturbing any settings or creating any new thing.

What if after successful build and deployment I commit the docker container to create a new image and use that image with new db pointer, shall that solves my problem.

My only basic requirement is to change db IP and nothing else.

[primetomas]

When there are existing CAs in the database EJBCA never creates a new ManagementCA, so you don't have to worry about that. You will always keep the management CA and superadmin that is in the database from the initial installation, for all nodes in a cluster that connects to the same database.

You pass the database IP as environment variable, the way to re-point a container is to stop it and start it again with a different database IP.

There are several ways. If you persist things, existing TLS certificates should remain. See the TLS environment variables.

The "pro" way to do it is to use PODs with an EJBCA node and an ingress (Apache/Nginx) and you can stop/start/restart PODs as you please. Then you would use TLS_SETUP=later and have the end-point TLS certificate in the ingress. Something like the attached image.

[primetomas]

Here is a nice video going through deployment with Helm charts and pods.
https://www.youtube.com/watch?v=C9dprcbCo4o

[primetomas]

I just realized that here tutorial of a kubernetes depoyment, using an ingress for the TLS front-end and a MariaDB database backend.
https://doc.primekey.com/ejbca/tutorials-and-guides/tutorial-deploy-ejbca-container-in-microk8s