support custom CA bundle for the api-server

Arvados-DCO-1.1-Signed-off-by: Michael Ludwig <michael.david.ludwig@gmail.com>

diff --git a/charts/arvados/templates/api-server-deployment.yaml b/charts/arvados/templates/api-server-deployment.yaml
index 7b5bb5ce062378c754d5373d95c719553188b5b8..4f90fcaeb5ec5026b60377c02d75665cbe0346d5 100644 (file)
--- a/charts/arvados/templates/api-server-deployment.yaml
+++ b/charts/arvados/templates/api-server-deployment.yaml
@@ -49,6 +49,11 @@ spec:
             - name: api-server-configmap
               mountPath: /etc/nginx/sites-enabled/api-server.conf
               subPath: nginx.conf
+            {{- if .Values.customCABundle }}
+            - name: custom-ca-bundle-volume
+              mountPath: /etc/ssl/certs/ca-certificates.crt
+              subPath: custom-ca-bundle.pem
+            {{- end }}
         - name: arvados-controller
           image: "cure/arvados-runtime"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
@@ -86,3 +91,8 @@ spec:
         - name: nginx-configmap
           configMap:
             name: arvados-api-server-https-configmap
+        {{- if .Values.customCABundle }}
+        - name: custom-ca-bundle-volume
+          configMap:
+            name: custom-ca-bundle-configmap
+        {{- end }}

diff --git a/charts/arvados/templates/custom-ca-bundle-configmap.yaml b/charts/arvados/templates/custom-ca-bundle-configmap.yaml
new file mode 100644 (file)
index 0000000..580b4d9
--- /dev/null
+++ b/charts/arvados/templates/custom-ca-bundle-configmap.yaml
@@ -0,0 +1,16 @@
+# Copyright (C) The Arvados Authors. All rights reserved.
+#
+# SPDX-License-Identifier: Apache-2.0
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: custom-ca-bundle-configmap
+  labels:
+    app: {{ template "arvados.name" . }}
+    chart: {{ template "arvados.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+data:
+  custom-ca-bundle.pem: |
+{{ .Values.customCABundle | indent 4 }}

diff --git a/charts/arvados/values.yaml b/charts/arvados/values.yaml
index 724cfd88b586de3fd3cf335a8e8dd2c6e4b9a1fe..e17804c039c7a58208c4c19f217684133a2b5667 100644 (file)
--- a/charts/arvados/values.yaml
+++ b/charts/arvados/values.yaml
@@ -58,3 +58,8 @@ arvados:
       arvados: 2.0.2
       arvadosCLI: 2.0.2
       arvadosLoginSync: 2.0.2
+
+# A custom bundle of CA certificates to use.
+# Useful for corporate networks with TLS proxies.
+# Set it by using the --set-file Helm argument.
+customCABundle: ""