Merge pull request #112 from snyk/fix/missing-caCert-data

fix: create volume mount with cacert when caCertFile is defined
snyk · Apr 3, 2024 · 895d701 · 895d701
2 parents 0350353 + bb626fc
commit 895d701
Show file tree

Hide file tree

Showing 20 changed files with 125 additions and 96 deletions.
diff --git a/charts/snyk-broker/Chart.yaml b/charts/snyk-broker/Chart.yaml
@@ -1,5 +1,5 @@
 apiVersion: v2
 name: snyk-broker
-version: 2.6.2
+version: 2.6.3
 description: A Helm chart for Kubernetes
 type: application
diff --git a/charts/snyk-broker/templates/broker_deployment.yaml b/charts/snyk-broker/templates/broker_deployment.yaml
@@ -86,7 +86,7 @@ spec:
                 mountPath: /home/node/private
                 readOnly: true
               {{- end }}
-              {{- if .Values.caCert }}
+              {{- if or (.Values.caCert) (.Values.caCertFile) }}
               - name: {{ include "snyk-broker.fullname" . }}-cacert-volume
                 mountPath: /home/node/cacert
                 readOnly: true
@@ -95,7 +95,7 @@ spec:
               - name: {{ include "snyk-broker.fullname" . }}-tls-secret-volume
                 mountPath: /home/node/tls-cert/
                 readOnly: true
-              {{- end }}                 
+              {{- end }}
 {{- if .Values.extraVolumeMounts }}
 {{ tpl (toYaml .Values.extraVolumeMounts | indent 14) . }}
 {{- end }}
@@ -373,14 +373,21 @@ spec:
               value: {{ .Values.logLevel }}
             - name: LOG_ENABLE_BODY
               value: {{ .Values.logEnableBody | squote }}
-             
-         {{- if .Values.caCert }}
+
+         {{- if and (.Values.caCert) (not .Values.caCertFile) }}
          # HTTPS Inspection 
             - name: CA_CERT
               value: /home/node/cacert/{{ .Values.caCert }}
             - name: NODE_EXTRA_CA_CERTS
               value: /home/node/cacert/{{ .Values.caCert }}
          {{- end }}
+         {{- if and (.Values.caCertFile) (not .Values.caCert) }}
+          # HTTPS Inspection
+            - name: CA_CERT
+              value: /home/node/cacert/cacert
+            - name: NODE_EXTRA_CA_CERTS
+              value: /home/node/cacert/cacert
+         {{- end }}
 
          {{- if .Values.httpsCert }}
          # HTTPS Config
@@ -460,7 +467,7 @@ spec:
         configMap:
           name: {{ include "snyk-broker.fullname" . }}-accept-configmap{{if not .Values.disableSuffixes }}-{{ .Release.Name }}{{ end }}
       {{- end }}
-      {{- if .Values.caCert }}
+      {{- if or (.Values.caCert) (.Values.caCertFile) }}
       - name: {{ include "snyk-broker.fullname" . }}-cacert-volume
         configMap:
           name: {{ include "snyk-broker.fullname" . }}-cacert-configmap{{if not .Values.disableSuffixes }}-{{ .Release.Name }}{{ end }}

diff --git a/charts/snyk-broker/templates/cacert_configmap.yaml b/charts/snyk-broker/templates/cacert_configmap.yaml
@@ -19,5 +19,5 @@ metadata:
   labels:
     {{- include "snyk-broker.labels" . | nindent 4 }}
 data:
-  cacert: {{ .Values.caCertFile | nindent 4}}
+  cacert: {{ .Values.caCertFile | toYaml | nindent 4}}
 {{- end }}
diff --git a/charts/snyk-broker/tests/__snapshot__/broker_cra_deployment_disablesuffixes_test.yaml.snap b/charts/snyk-broker/tests/__snapshot__/broker_cra_deployment_disablesuffixes_test.yaml.snap
@@ -7,7 +7,7 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: container-registry-agent-broker-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -108,7 +108,7 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: container-registry-agent-broker-service-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -135,6 +135,6 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: snyk-broker-RELEASE-NAME
       namespace: NAMESPACE
diff --git a/charts/snyk-broker/tests/__snapshot__/broker_cra_deployment_test.yaml.snap b/charts/snyk-broker/tests/__snapshot__/broker_cra_deployment_test.yaml.snap
@@ -7,7 +7,7 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: container-registry-agent-broker-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -108,7 +108,7 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: container-registry-agent-broker-service-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -135,6 +135,6 @@ with CRA:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: snyk-broker-RELEASE-NAME
       namespace: NAMESPACE
diff --git a/charts/snyk-broker/tests/__snapshot__/broker_deployment_apprisk_test.yaml.snap b/charts/snyk-broker/tests/__snapshot__/broker_deployment_apprisk_test.yaml.snap
@@ -7,7 +7,7 @@ apprisk enabled:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -107,7 +107,7 @@ apprisk enabled:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-service-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -134,6 +134,6 @@ apprisk enabled:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: snyk-broker-RELEASE-NAME
       namespace: NAMESPACE
diff --git a/...snyk-broker/tests/__snapshot__/broker_deployment_configmap_disablesuffixes_test.yaml.snap b/...snyk-broker/tests/__snapshot__/broker_deployment_configmap_disablesuffixes_test.yaml.snap
@@ -7,7 +7,7 @@ cacert:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker
       namespace: NAMESPACE
     spec:
@@ -115,7 +115,7 @@ cacert:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-service
       namespace: NAMESPACE
     spec:
@@ -157,7 +157,7 @@ cacert:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: RELEASE-NAME-snyk-broker-cacert-configmap
       namespace: NAMESPACE
   4: |
@@ -176,7 +176,7 @@ cacert:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: snyk-broker
       namespace: NAMESPACE
 cacertfile:
@@ -188,7 +188,7 @@ cacertfile:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker
       namespace: NAMESPACE
     spec:
@@ -229,6 +229,10 @@ cacertfile:
                   value: info
                 - name: LOG_ENABLE_BODY
                   value: "false"
+                - name: CA_CERT
+                  value: /home/node/cacert/cacert
+                - name: NODE_EXTRA_CA_CERTS
+                  value: /home/node/cacert/cacert
                 - name: ACCEPT_CODE
                   value: "true"
                 - name: ACCEPT_IAC
@@ -274,10 +278,16 @@ cacertfile:
                 readOnlyRootFilesystem: true
                 runAsNonRoot: true
                 runAsUser: 1000
-              volumeMounts: null
+              volumeMounts:
+                - mountPath: /home/node/cacert
+                  name: RELEASE-NAME-snyk-broker-cacert-volume
+                  readOnly: true
           securityContext: {}
           serviceAccountName: snyk-broker
-          volumes: null
+          volumes:
+            - configMap:
+                name: RELEASE-NAME-snyk-broker-cacert-configmap
+              name: RELEASE-NAME-snyk-broker-cacert-volume
   2: |
     apiVersion: v1
     kind: Service
@@ -286,7 +296,7 @@ cacertfile:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-service
       namespace: NAMESPACE
     spec:
@@ -307,7 +317,7 @@ cacertfile:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: RELEASE-NAME-snyk-broker-cacert-configmap
       namespace: NAMESPACE
   4: |
@@ -326,6 +336,6 @@ cacertfile:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: snyk-broker
       namespace: NAMESPACE
diff --git a/charts/snyk-broker/tests/__snapshot__/broker_deployment_configmap_test.yaml.snap b/charts/snyk-broker/tests/__snapshot__/broker_deployment_configmap_test.yaml.snap
@@ -7,7 +7,7 @@ cacert:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -115,7 +115,7 @@ cacert:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-service-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -157,7 +157,7 @@ cacert:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: RELEASE-NAME-snyk-broker-cacert-configmap-RELEASE-NAME
       namespace: NAMESPACE
   4: |
@@ -176,7 +176,7 @@ cacert:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: snyk-broker-RELEASE-NAME
       namespace: NAMESPACE
 cacertfile:
@@ -188,7 +188,7 @@ cacertfile:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -229,6 +229,10 @@ cacertfile:
                   value: info
                 - name: LOG_ENABLE_BODY
                   value: "false"
+                - name: CA_CERT
+                  value: /home/node/cacert/cacert
+                - name: NODE_EXTRA_CA_CERTS
+                  value: /home/node/cacert/cacert
                 - name: ACCEPT_CODE
                   value: "true"
                 - name: ACCEPT_IAC
@@ -274,10 +278,16 @@ cacertfile:
                 readOnlyRootFilesystem: true
                 runAsNonRoot: true
                 runAsUser: 1000
-              volumeMounts: null
+              volumeMounts:
+                - mountPath: /home/node/cacert
+                  name: RELEASE-NAME-snyk-broker-cacert-volume
+                  readOnly: true
           securityContext: {}
           serviceAccountName: snyk-broker-RELEASE-NAME
-          volumes: null
+          volumes:
+            - configMap:
+                name: RELEASE-NAME-snyk-broker-cacert-configmap-RELEASE-NAME
+              name: RELEASE-NAME-snyk-broker-cacert-volume
   2: |
     apiVersion: v1
     kind: Service
@@ -286,7 +296,7 @@ cacertfile:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-service-RELEASE-NAME
       namespace: NAMESPACE
     spec:
@@ -307,7 +317,7 @@ cacertfile:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: RELEASE-NAME-snyk-broker-cacert-configmap-RELEASE-NAME
       namespace: NAMESPACE
   4: |
@@ -326,6 +336,6 @@ cacertfile:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker-RELEASE-NAME
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: snyk-broker-RELEASE-NAME
       namespace: NAMESPACE
diff --git a/...k-broker/tests/__snapshot__/broker_deployment_customaccept_disablesuffixes_test.yaml.snap b/...k-broker/tests/__snapshot__/broker_deployment_customaccept_disablesuffixes_test.yaml.snap
@@ -9,7 +9,7 @@ customaccept values:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: RELEASE-NAME-snyk-broker-accept-configmap
       namespace: NAMESPACE
   2: |
@@ -20,7 +20,7 @@ customaccept values:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker
       namespace: NAMESPACE
     spec:
@@ -122,7 +122,7 @@ customaccept values:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: github-com-broker-service
       namespace: NAMESPACE
     spec:
@@ -149,6 +149,6 @@ customaccept values:
         app.kubernetes.io/instance: RELEASE-NAME
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/name: snyk-broker
-        helm.sh/chart: snyk-broker-2.6.2
+        helm.sh/chart: snyk-broker-2.6.3
       name: snyk-broker
       namespace: NAMESPACE