Add example of mysql using spire (#164)

* Add example of mysql using spire Signed-off-by: Kevin Fox <[email protected]> * Finish up the implementation Signed-off-by: Kevin Fox <[email protected]> * Update the image Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Update. Restested. Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
2024-02-05 11:17:19 -08:00
parent 350ec89ff2
commit fce95cb443
5 changed files with 262 additions and 0 deletions
@@ -0,0 +1,21 @@
+```
+helm upgrade --install -n spire-server spire-crds spire-crds --repo https://spiffe.github.io/helm-charts-hardened/ --create-namespace --version 0.3.0
+helm upgrade --install -n spire-server spire spire --repo https://spiffe.github.io/helm-charts-hardened/ --version 0.17.1 -f spire-values.yaml
+
+kubectl apply -f mysqlclient-configmap.yaml
+kubectl apply -f mysqlclient-statefulset.yaml
+
+kubectl wait pod mysqlclient-0 --for=condition=ready --timeout=60s
+
+# Run, and get the x500UniqueIdentifier value:
+kubectl exec -it mysqlclient-0 -c main -- bash -c 'openssl x509 -in /certs/tls.crt -noout -text | grep Subject:'
+
+# Edit mysql-values.yaml and update the x509UniqueIdentifer
+vim mysql-values.yaml
+
+helm upgrade --install -f mysql-values.yaml mysql mysql --version 9.15.0 --repo https://charts.bitnami.com/bitnami
+
+kubectl wait pod mysql-0 --for=condition=ready --timeout=60s
+
+kubectl exec -it mysqlclient-0 -- bash -c 'mysql -u mysqlclient --protocol tcp --ssl-key /certs/tls.key --ssl-cert /certs/tls.crt --ssl-ca /certs/ca.pem -h mysql.default.svc.cluster.local'
+```