Skip to content

docs(kubernetes): frame README for starting-point and distributed-deployment audiences#702

Merged
bradymiller merged 1 commit intoopenemr:masterfrom
bradymiller:document-kubernetes
May 10, 2026
Merged

docs(kubernetes): frame README for starting-point and distributed-deployment audiences#702
bradymiller merged 1 commit intoopenemr:masterfrom
bradymiller:document-kubernetes

Conversation

@bradymiller
Copy link
Copy Markdown
Member

Summary

  • Restructures kubernetes/README.md so it explicitly serves two related goals: a working OpenEMR starting point on Kubernetes, and a reference for the security primitives needed when components are deployed across trust boundaries (different clusters, VPCs, or over the public internet).
  • Moves the Use section directly after Overview so readers can try the stack immediately without scrolling past architecture content.
  • Adds Security Architecture — per-layer threat model covering MariaDB / Redis mTLS (what each property protects, where it's load-bearing vs. defense-in-depth), the NFS shared-volume in-transit gap, at-rest storage status, secrets management, and network policies.
  • Adds Production Hardening — encryption-at-rest options per cloud (AWS / GCP / Azure / on-prem), MariaDB Transparent Data Encryption (TDE) recipe using the built-in file_key_management plugin, CNI-level WireGuard guidance for the NFS in-transit gap, and a production checklist.
  • Drops half-supported minikube references in favor of focused Kind instructions; "other distributions can be substituted by users familiar with their networking and storage models" remains as a note.
  • Updates the base README.md summary line to name both purposes ("Working starting point with mTLS, Redis Sentinel failover, multi-node support; also serves as a reference for secure distributed deployments").

No code or manifest changes — documentation only.

Test plan

  • Render kubernetes/README.md on GitHub and verify section navigation flows: Overview → Use → Security Architecture → Connection Security → Production Hardening
  • Confirm existing operational instructions (kub-up, scaling, sentinel failover, kub-down) are preserved verbatim
  • Verify the existing Connection Security downgrade paths (MariaDB / Redis mTLS → TLS → TCP) are unchanged
  • Verify the base README.md Kubernetes link still resolves to kubernetes/

🤖 Generated with Claude Code

…ibuted-deployment audiences

Restructure kubernetes/README.md so it explicitly serves two goals: a
working OpenEMR starting point on Kubernetes, and a reference for the
security primitives needed when components are deployed across trust
boundaries. Move the Use section directly after Overview so readers can
try the stack quickly. Add Security Architecture (per-layer threat
model, including the NFS in-transit gap), and Production Hardening
(storage-layer encryption per cloud, MariaDB TDE recipe, CNI-level
WireGuard guidance, production checklist). Drop half-supported minikube
references in favor of focused Kind instructions. Update the base
README summary line to name both purposes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings May 10, 2026 06:08
Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR restructures the Kubernetes documentation to better serve both “get it running quickly” users and readers deploying components across trust boundaries who need a clearer security model.

Changes:

  • Reorders and reframes kubernetes/README.md (Overview → Use early), adding new “Security Architecture”, “Connection Security”, and “Production Hardening” sections.
  • Removes Minikube-specific instructions in favor of Kind-focused guidance.
  • Updates the repo root README.md Kubernetes entry to reflect the README’s dual purpose (starting point + distributed-deployment security reference).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
README.md Expands the Kubernetes entry to describe the Kubernetes docs as both a runnable starting point and a secure distributed-deployment reference.
kubernetes/README.md Major reorganization plus added security/threat-model and production-hardening guidance.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread kubernetes/README.md

## In-transit: Redis connections

OpenEMR ↔ Redis and OpenEMR ↔ Sentinel use mTLS via phpredis with Sentinel-based master discovery (`SESSION_STORAGE_MODE=predis-sentinel`). The `tls-auth-clients yes` setting in `redis/configmap-main.yaml` enforces client certificate presentation. Same three properties as MariaDB above.
Comment thread kubernetes/README.md
Comment on lines +15 to +18
OpenEMR Kubernetes orchestration. Orchestration includes OpenEMR, MariaDB, Redis, and phpMyAdmin.
- **OpenEMR** - 3 deployment replications of OpenEMR are created. Replications can be increased/decreased. Ports for both http and https.
- **MariaDB** - 2 statefulset replications of MariaDB (1 primary/master with 1 replica/slave) are created. Replications can be increased/decreased which will increase/decrease number of replica/slaves. Connections use mTLS (mutual TLS / X509 client certificate verification) by default, including replication traffic. See **Security Architecture → MariaDB connections** for what this protects and **Connection Security → MariaDB Connection Security** for how to downgrade to TLS-only or plain TCP.
- **Redis** - Configured to support failover. There is 1 master and 2 slaves (no read access on slaves) for a statefulset and 3 sentinels for another statefulset. OpenEMR connects directly to Redis with mTLS (mutual TLS / X509 client certificate verification) by default. The primary/slaves and sentinels would require script changes if wish to increase/decrease replicates for these since these are hard-coded several places in the scripts. There are 3 users/passwords (`default`, `replication`, `admin`) used in this redis scheme. All passwords are stored in the `redis-credentials` Kubernetes Secret (redis/secret.yaml) and should be changed for production use. The `default` is the typical worker/app/client user. See **Security Architecture → Redis connections** for details and **Connection Security → Redis Connection Security** for how to downgrade.
@bradymiller bradymiller merged commit a4e744c into openemr:master May 10, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants