official container image is production and k8s ready?

[umegaya]

hi, thank you for building official ejbca-ce docker image . I could setup quick start with authentication with external database within a few hours on eks fargate.

but I have a few question about the container image.

• my deployment on eks fargate seems to work fine with some test (eg. admin web operation, issuing cert with ejbca-rest-api/v1/certificate API), but the image is assumed to run on k8s? for example, if container has no persistent volume and got restarted, content in container's ephemeral file system is lost. does it cause any problem?
  • EDIT: ok I found https://hub.docker.com/layers/keyfactor/ejbca-ce/7.10.0.2/images/sha256-4e4df397f38b616e082cbe83df51306d3f3105e3274492ce4399555008e57e20?context=explore has VOLUME [/mnt/persistent] so probably it should be saved into persistent volume, right? if so, any other concern run the image in k8s environment, where ephemeral files are often lost?
• is the image fully functional for advanced deployment for production usage, like working with HSM, high availability and clustering, only by changing configurations? or should I build home brewed container image for these purpose?

regards,

[primetomas]

The image is fully functional.
You can find some container related tools, examples and documentation in our ejbca-containers GitHub repo. https://github.com/Keyfactor/ejbca-containers

[primetomas]

The only thing you need to persist with EJBCA is the database contents. Very k8s friendly. The container itself should be used as ephemeral.

[umegaya]

@primetomas hi, thank you for your reply (and sorry for late), https://github.com/Keyfactor/ejbca-containers was useful for knowing how to integrate hsm in our system. we found the image is fully functional and has many customization point, now we think of going with the image for production deployment 👍

[primetomas]

That's great. If you need Enterprise SLA, we are here to help. https://www.keyfactor.com/platform/keyfactor-ejbca-enterprise/