When deploying with k8s, the superadmin and corresponding password are not displayed #299

raydoom · 2023-06-07T07:47:23Z

raydoom
Jun 7, 2023

When deploying with k8s, the superadmin and corresponding password are not displayed in the logs, but they can be displayed when deploying with docker.
deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ejbca
  labels:
    app: ejbca
spec:
  selector:
    matchLabels:
      app: ejbca
  template:
    metadata:
      labels:
        app: ejbca
    spec:
      hostname: ejbca-k8s
      containers:
        - name: ejbca
          image: keyfactor/ejbca-ce:7.11.0
          ports:
          - containerPort: 8080
            name: http
          - containerPort: 8443
            name: https
          env: 
          - name: DATABASE_JDBC_URL
            value: "jdbc:mysql://ejbca-mysql:3306/ejbca?characterEncoding=UTF-8" 
          - name: DATABASE_USER
            value: "root"            
          - name: DATABASE_PASSWORD
            value: "111111"   
          - name: LOG_LEVEL_APP
            value: "WARN"            
          - name: LOG_LEVEL_SERVER
            value: "WARN"            
          - name: LOG_LEVEL_SERVER_SUBSYSTEMS
            value: "WARN"            
          - name: LOG_LEVEL_APP_WS_TRANSACTIONS
            value: "WARN"

logs

023-06-07 07:26:19,705+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) Enabling HTTPS listener on 0.0.0.0:8443 with optional client certificate authentication.
2023-06-07 07:26:33,354+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) Enabling HTTP listener on 0.0.0.0:8080.
2023-06-07 07:26:39,694+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) Enabling HSTS
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #######################################################################################################
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #                                                                                                     #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # Whenever you are ready for production:                                                              #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #                                                                                                     #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # Try out the commercially supported EJBCA Enterprise Cloud on AWS or Azure, fully featured with:     #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # - Additional enrollment APIs such as a complete REST API, EST, ACME and more.                       #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # - Support for external Registration Authority and OCSP responders                                   #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # - Hardware Security Module support                                                                  #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # - Application updates                                                                               #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # - ...and more!                                                                                      #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #                                                                                                     #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # Feel free to contact us directly for a cloud, on-prem, SaaS, embedded or hybrid solution that fits  #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) # your specific needs.                                                                                #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #                                                                                                     #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #           https://aws.amazon.com/marketplace/seller-profile?id=7edf9048-58e6-4086-9d98-b8e0c1d78fce #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #     https://azuremarketplace.microsoft.com/en-us/marketplace/apps/primekey.ejbca_enterprise_cloud_2 #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #                                                                                                     #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #                                                                           https://www.keyfactor.com #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #                                                                                 [email protected] #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #                                                                                                     #
2023-06-07 07:26:54,160+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) #######################################################################################################
2023-06-07 07:26:54,173+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) Waiting 5 seconds before signaling application readiness to ensure proper handling of PublicAccessAuthenticationToken.
2023-06-07 07:26:59,184+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) Health check now reports application status at /ejbca/publicweb/healthcheck/ejbcahealth
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) *****************************************************************************************
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) *                                                                                       *
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) * A fresh installation was detected and a ManagementCA was created for your initial     *
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) * access to the system.                                                                 *
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) *                                                                                       *
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) *   URL:      https://ejbca-k8s:443/ejbca/adminweb/                                     *
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) *                                                                                       *
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) * If you use different port mapping or a proxy, please adapt the URL above accordingly. *
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) *                                                                                       *
2023-06-07 07:26:59,190+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) *****************************************************************************************

Use docker

docker run -d --name=ejbca -p 80:8080 -p 443:8443 -h ejbca.maxd.cf -e "DATABASE_JDBC_URL=jdbc:mysql://192.168.1.15:3306/ejbca?characterEncoding=UTF-8" -e "DATABASE_USER=root" -e "DATABASE_PASSWORD=111111" -e "LOG_LEVEL_APP=WARN" -e "LOG_LEVEL_SERVER=WARN" -e "LOG_LEVEL_SERVER_SUBSYSTEMS=WARN" -e "LOG_LEVEL_APP_WS_TRANSACTIONS=WARN" keyfactor/ejbca-ce:7.11.0

logs

2023-06-07 01:11:04,660+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) Enabling HTTPS listener on 0.0.0.0:8443 with optional client certificate authentication.
2023-06-07 01:11:17,417+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) Enabling HTTP listener on 0.0.0.0:8080.
2023-06-07 01:11:31,812+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) Health check now reports application status at /ejbca/publicweb/healthcheck/ejbcahealth
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) 
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) **************************************************************************************
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) * A fresh installation was detected and a ManagementCA was created for your initial  *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) * administaration of the system.                                                     *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) *                                                                                    *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) * Initial SuperAdmin client certificate enrollment URL (adapt port to your mapping): *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) *                                                                                    *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) *   URL:      https://ejbca.maxd.cf:443/ejbca/enrol/keystore.jsp
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) *   Username: superadmin                                                             *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) *   Password: X7u4GBFM9R90+uBqQBIi1P/B                                               *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) *                                                                                    *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) * Once the P12 is downloaded, use "X7u4GBFM9R90+uBqQBIi1P/B" to import it.           *
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1) **************************************************************************************
2023-06-07 01:11:31,842+0000 INFO  [/opt/primekey/bin/start.sh] (process:1)

primetomas · 2023-06-07T07:57:46Z

primetomas
Jun 7, 2023
Maintainer

You should use -e TLS_SETUP_ENABLED="true" in both scenarios. "simple" is the default in the current docker version as well I believe, are you running an older container version with the docker command?

0 replies

raydoom · 2023-06-08T01:46:36Z

raydoom
Jun 8, 2023
Author

This is the images i used in docker command,

docker images | grep ejbca
keyfactor/ejbca-ce                                            7.11.0                                     d7633bc9a2dd   4 months ago    565MB

But I repull it

keyfactor/ejbca-ce                                            7.11.0                                     69303f09735f   3 days ago      568MB

I think the version number is same, But the content wab updated

0 replies

raydoom · 2023-06-08T02:45:36Z

raydoom
Jun 8, 2023
Author

I have another question:

If I do not use -e TLS_SETUP_ENABLED="true", webadmin can be accessed normally, but the rest api shows unauthorized:

"error_code": 403, 
"error_message": "Error no client certificate or OAuth token received for authentication."

Then I added a user and assigned the Super Administrator Role. Should I be able to access the rest api using the user's certificate?
Or do I have to use -e TLS_SETUP_ENABLED="true" to access the rest api?
2. After deploying ejbca and mysql with the following YAML

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ejbca-mysql
  labels:
    app: ejbca-mysql
spec:
  selector:
    matchLabels:
      app: ejbca-mysql
  template:
    metadata:
      labels:
        app: ejbca-mysql
    spec:
      containers:
        - name: ejbca-mysql
          image: mysql:latest
          volumeMounts:
          - mountPath: "/var/lib/mysql"
            name: ejbca-mysql-data
          ports:
          - containerPort: 3306
          env: 
          - name: MYSQL_ROOT_PASSWORD
            value: "111111"
          - name: MYSQL_DATABASE
            value: ejbca
          resources:
            requests:
              memory: 1024Mi
              cpu: 250m
            limits:
              memory: 4096Mi
              cpu: 2000m
          livenessProbe:
            tcpSocket:
              port: 3306
            initialDelaySeconds: 15
            periodSeconds: 20
      imagePullSecrets:
        - name: regcred
      volumes:
      - name: ejbca-mysql-data
        persistentVolumeClaim:
          claimName: ejbca-mysql-data

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ejbca
  labels:
    app: ejbca
spec:
  selector:
    matchLabels:
      app: ejbca
  template:
    metadata:
      labels:
        app: ejbca
    spec:
      hostname: ejbca-k8s
      containers:
        - name: ejbca
          image: keyfactor/ejbca-ce:7.11.0
          ports:
          - containerPort: 8080
            name: http
          - containerPort: 8443
            name: https
          env: 
          - name: DATABASE_JDBC_URL
            value: "jdbc:mysql://ejbca-mysql:3306/ejbca?characterEncoding=UTF-8" 
          - name: DATABASE_USER
            value: "root"            
          - name: DATABASE_PASSWORD
            value: "111111" 
          - name: LOG_LEVEL_APP
            value: "WARN"            
          - name: LOG_LEVEL_SERVER
            value: "WARN"            
          - name: LOG_LEVEL_SERVER_SUBSYSTEMS
            value: "WARN"            
          - name: LOG_LEVEL_APP_WS_TRANSACTIONS
            value: "WARN"                                
          resources:
            requests:
              memory: 1024Mi
              cpu: 250m
            limits:
              memory: 4096Mi
              cpu: 2000m

---
kind: Service
apiVersion: v1
metadata:
  name: ejbca-mysql
  namespace: default
spec:
  selector:
    app: ejbca-mysql
  ports:
    - protocol: TCP
      port: 3306
      targetPort: 3306              
---

apiVersion: v1
kind: Service
metadata:
  name: ejbca
spec:
  selector:
    app: ejbca
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: http
    - name: https
      protocol: TCP
      port: 443
      targetPort: https
  type: LoadBalancer
  
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: ejbca-mysql-data
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 200Gi

the ejbca pod will consistently loop the following logs. After log in to mysql using another mysql client (mysql -uroot -p -hejbca-mysql), ejbca will continue to deploy.

2023-06-08 02:15:29,593+0000 INFO  [org.apache.commons.beanutils.FluentPropertyBeanIntrospector] (main) Error when creating PropertyDescriptor for public final void org.apache.commons.configuration2.AbstractConfiguration.setProperty(java.lang.String,java.lang.Object)! Ignoring this property. 
2023-06-08 02:15:30,062+0000 ERROR [org.ejbca.ui.cli.jdbc.JdbcTool] (main) RSA public key is not available client side (option serverRsaPublicKeyFile not set)
2023-06-08 02:15:30,063+0000 INFO  [org.ejbca.ui.cli.jdbc.JdbcTool] (main) Done.
2023-06-08 02:15:30,111+0000 INFO  [/opt/keyfactor/bin/start.sh] (process:1) Waiting for external database 'jdbc:mariadb://ejbca-mysql:3306/ejbca?characterEncoding=UTF-8' to become available.

0 replies

raydoom · 2023-06-08T06:29:25Z

raydoom
Jun 8, 2023
Author

I used the latest images 7.11.0,and when l open https://ejbca-k8s:443/ejbca/ra/enrollwithusername.xhtml?username=superadmin ，input the password， it said

end entity with name 'superadmin' does not exist, status was wrong or enrollment code was incorrect

0 replies

primetomas · 2023-06-19T07:13:11Z

primetomas
Jun 19, 2023
Maintainer

I got the same as you. You can use the public web. I'll report it.
https://mycahostname/ejbca/enrol/keystore.jsp

1 reply

primetomas Jun 19, 2023
Maintainer

This is a new topic though, it's better if you create a new issue for that. I'll close this one for now, the password was displayed I take it :-)

primetomas · 2023-06-19T08:32:36Z

primetomas
Jun 19, 2023
Maintainer

Just got a note here. The script printing the link was updated for the coming EJBCA release, while the new software will make it work with that link. The new release will be up rather shortly, within two weeks or so. In the meantime, use the PublicWeb link above.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

When deploying with k8s, the superadmin and corresponding password are not displayed #299

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 6 comments 1 reply

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

When deploying with k8s, the superadmin and corresponding password are not displayed #299

raydoom Jun 7, 2023

Replies: 6 comments · 1 reply

primetomas Jun 7, 2023 Maintainer

raydoom Jun 8, 2023 Author

raydoom Jun 8, 2023 Author

raydoom Jun 8, 2023 Author

primetomas Jun 19, 2023 Maintainer

primetomas Jun 19, 2023 Maintainer

primetomas Jun 19, 2023 Maintainer

raydoom
Jun 7, 2023

Replies: 6 comments 1 reply

primetomas
Jun 7, 2023
Maintainer

raydoom
Jun 8, 2023
Author

raydoom
Jun 8, 2023
Author

raydoom
Jun 8, 2023
Author

primetomas
Jun 19, 2023
Maintainer

primetomas Jun 19, 2023
Maintainer

primetomas
Jun 19, 2023
Maintainer