EJBCA Installed Resources

On StarlingX, EJBCA is deployed as the optional app-ejbca platform application and includes the following components:

  • EJBCA CE — the core PKI engine (LGPL-2.1+ licensed).

  • ejbca-cert-manager-issuer — cert-manager integration for Kubernetes-native certificate issuance (Apache 2.0).

  • cert-manager-approver-policy — policy controller for CertificateRequest approval (Apache 2.0). Provides integration with cert-manager together with ejbca-cert-manager-issuer.

  • CloudNativePG — PostgreSQL operator that manages database cluster lifecycle (Apache 2.0).

  • ejbca-pg-cluster — CloudNativePG database Cluster providing HA PostgreSQL persistence.

  • Apache httpd sidecar — reverse proxy providing mTLS termination for the EJBCA service.

  • A companion optional open source application, Stakater Reloader (app-reloader) is also introduced. When installed, it automatically restarts pods whenever cert-manager renews the EJBCA TLS certificate secret, allowing the httpd sidecar to load the updated certificate without requiring manual intervention. For more information about Stakater Reloader, see: https://github.com/stakater/Reloader.

Deploying app-ejbca also reconfigures the platform to allow external access to the EJBCA service:

  • HAProxy integration — SSL passthrough for external traffic to EJBCA.

  • OAM GlobalNetworkPolicy — opens port 7443 to allow ingress TCP traffic.

The application runs in the ejbca namespace and exposes services externally through the platform HAProxy load balancer on OAM port 7443.