search-api: custom CA certificates support (#478)

2gis · Aug 26, 2024 · 576873d · 576873d
1 parent 0bb2be5
commit 576873d
Show file tree

Hide file tree

Showing 5 changed files with 76 additions and 2 deletions.
diff --git a/charts/search-api/README.md b/charts/search-api/README.md
@@ -142,6 +142,13 @@ See the [documentation](https://docs.2gis.com/en/on-premise/search) to learn abo
 | `nginx.resources.limits.cpu`      | A CPU limit, e.g., `100m`        |       |
 | `nginx.resources.limits.memory`   | A memory limit, e.g., `128Mi`    |       |
 
+### customCAs **Custom Certificate Authority**
+
+| Name                  | Description                                                                                                                 | Value |
+| --------------------- | --------------------------------------------------------------------------------------------------------------------------- | ----- |
+| `customCAs.bundle`    | Custom CA [text representation of the X.509 PEM public-key certificate](https://www.rfc-editor.org/rfc/rfc7468#section-5.1) | `""`  |
+| `customCAs.certsPath` | Custom CA bundle mount directory in the container.                                                                          | `""`  |
+
 
 ## Maintainers
 

diff --git a/charts/search-api/templates/_helpers.tpl b/charts/search-api/templates/_helpers.tpl
@@ -37,6 +37,28 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{- printf "{\"auths\": {\"%s\": {\"auth\": \"%s\"}}}" .registry (printf "%s:%s" .username .password | b64enc) | b64enc }}
 {{- end }}
 
+{{- define "search_api.env.custom.ca.path" -}}
+- name: SSL_CERT_FILE
+  value: {{ include "search_api.custom.ca.mountPath" . }}/custom-ca.crt
+{{- end }}
+
+{{- define "search_api.custom.ca.mountPath" -}}
+{{ .Values.customCAs.certsPath | default "/usr/local/share/ca-certificates" }}
+{{- end -}}
+
+{{- define "search_api.custom.ca.volumeMounts" -}}
+- name: custom-ca
+  mountPath: {{ include "search_api.custom.ca.mountPath" . }}/custom-ca.crt
+  subPath: custom-ca.crt
+  readOnly: true
+{{- end -}}
+
+{{- define "search_api.custom.ca.deploys.volumes" -}}
+- name: custom-ca
+  configMap:
+    name: {{ include "search_api.fullname" . }}
+{{- end -}}
+
 {{/*
 Return the target Kubernetes version
 */}}

diff --git a/charts/search-api/templates/configmap.yaml b/charts/search-api/templates/configmap.yaml
@@ -74,3 +74,7 @@ data:
             }
         }
     }
+{{- if .Values.customCAs.bundle }}
+  custom-ca.crt: |-
+{{- .Values.customCAs.bundle | nindent 4 }}
+{{- end }}
diff --git a/charts/search-api/templates/deployment.yaml b/charts/search-api/templates/deployment.yaml
@@ -4,9 +4,14 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "search_api.fullname" . }}
-  {{- if .Values.annotations }}
+  {{- if or .Values.annotations .Values.customCAs.bundle }}
   annotations:
-    {{- toYaml .Values.annotations | nindent 4 }}
+    {{- if .Values.customCAs.bundle }}
+    checksum/config: {{ include (print .Template.BasePath "/configmap.yaml") . | sha256sum }}
+    {{- end }}
+    {{- with .Values.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}    
   {{- end }}
   labels:
     {{- include "search_api.labels" . | nindent 4 }}
@@ -53,6 +58,9 @@ spec:
               secretKeyRef:
                 name: {{ include "search_api.fullname" . }}
                 key: s3SecretKey
+          {{- if .Values.customCAs.bundle }}
+          {{- include "search_api.env.custom.ca.path" . | nindent 10 }}
+          {{- end }}
           command:
             - importer
             - --endpoint={{ required "Valid .Values.dgctlStorage.host required!" .Values.dgctlStorage.host }}
@@ -72,6 +80,9 @@ spec:
               mountPath: /etc/2gis
             - name: search-api-data
               mountPath: {{ .Values.api.dataDir }}
+          {{- if .Values.customCAs.bundle }}
+            {{- include "search_api.custom.ca.volumeMounts" . | nindent 12 }}
+          {{- end }}
       containers:
         - name: api
           image: {{ required "A valid .Values.dgctlDockerRegistry entry required" .Values.dgctlDockerRegistry }}/{{ .Values.api.image.repository }}:{{ .Values.api.image.tag }}
@@ -88,9 +99,16 @@ spec:
               mountPath: /etc/2gis
             - name: search-api-data
               mountPath: {{ .Values.api.dataDir }}
+          {{- if .Values.customCAs.bundle }}
+            {{- include "search_api.custom.ca.volumeMounts" . | nindent 12 }}
+          {{- end }}
           env:
             - name: REDEPLOY_LABEL
               value: "{{ .Values.redeployLabel }}"
+            {{- if .Values.customCAs.bundle }}
+            {{- include "search_api.env.custom.ca.path" . | nindent 12 }}
+            {{- end }}
+
         - name: nginx
           image: {{ required "A valid .Values.dgctlDockerRegistry entry required" .Values.dgctlDockerRegistry }}/{{ .Values.nginx.image.repository }}:{{ .Values.nginx.image.tag }}
           imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
@@ -122,6 +140,13 @@ spec:
           volumeMounts:
             - name: {{ include "search_api.name" $ }}-configmap
               mountPath: /etc/2gis
+          {{- if .Values.customCAs.bundle }}
+            {{- include "search_api.custom.ca.volumeMounts" . | nindent 12 }}
+          {{- end }}
+          env:
+            {{- if .Values.customCAs.bundle }}
+            {{- include "search_api.env.custom.ca.path" . | nindent 12 }}
+            {{- end }}
       volumes:
         - name: {{ include "search_api.name" . }}-configmap
           configMap:
@@ -133,6 +158,9 @@ spec:
                 path: nginx.conf
         - name: search-api-data
           emptyDir: {}
+        {{- if .Values.customCAs.bundle }}
+        {{- include "search_api.custom.ca.deploys.volumes" . | nindent 8 }}
+        {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}

diff --git a/charts/search-api/values.yaml b/charts/search-api/values.yaml
@@ -189,3 +189,16 @@ ingress:
 # @extra nginx.resources.requests.memory A memory request, e.g., `128Mi`
 # @extra nginx.resources.limits.cpu A CPU limit, e.g., `100m`
 # @extra nginx.resources.limits.memory A memory limit, e.g., `128Mi`
+
+# @section customCAs **Custom Certificate Authority**
+
+# @param customCAs.bundle Custom CA [text representation of the X.509 PEM public-key certificate](https://www.rfc-editor.org/rfc/rfc7468#section-5.1)
+# @param customCAs.certsPath Custom CA bundle mount directory in the container.
+
+customCAs:
+  bundle: ''
+# bundle: |
+    # -----BEGIN CERTIFICATE-----
+    # ...
+    # -----END CERTIFICATE-----
+  certsPath: ''