feat(truststore): declarative configuration of TLS trusted certificat…

…e Secrets
cryostatio · Nov 27, 2024 · 404547d · 404547d
1 parent b91e9bd
commit 404547d
Show file tree

Hide file tree

Showing 4 changed files with 32 additions and 0 deletions.
diff --git a/charts/cryostat/README.md b/charts/cryostat/README.md
@@ -84,6 +84,7 @@ helm install cryostat ./charts/cryostat
 | `core.discovery.kubernetes.portNames`                  | List of port names that the Cryostat application should look for in order to consider a target as JMX connectable                                                                                                                                                                                                                                                                                                                                                                                                                              | `[]`                        |
 | `core.discovery.kubernetes.builtInPortNumbersDisabled` | When false and `portNumbers` is empty, the Cryostat application will use the default port number `9091` to look for JMX connectable targets.                                                                                                                                                                                                                                                                                                                                                                                                   | `false`                     |
 | `core.discovery.kubernetes.portNumbers`                | List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable                                                                                                                                                                                                                                                                                                                                                                                                                            | `[]`                        |
+| `core.config.tlsTruststore.secretNames`                | List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.                                                                                                                                                                                                                                                                                                                | `[]`                        |
 
 ### Report Generator Deployment
 

diff --git a/charts/cryostat/templates/cryostat_deployment.yaml b/charts/cryostat/templates/cryostat_deployment.yaml
@@ -141,6 +141,12 @@ spec:
             failureThreshold: 18
           resources:
             {{- toYaml .Values.core.resources | nindent 12 }}
+          volumeMounts:
+          {{- range .Values.core.config.tlsTruststore.secretNames }}
+            - name: {{ . }}
+              mountPath: /truststore/{{ . }}
+              readOnly: true
+          {{- end }}
         - name: {{ printf "%s-%s" .Chart.Name "grafana" }}
           securityContext:
             {{- toYaml .Values.grafana.securityContext | nindent 12 }}
@@ -216,3 +222,8 @@ spec:
         secret:
           secretName: {{ .Release.Name }}-proxy-tls
       {{- end }}
+      {{- range .Values.core.config.tlsTruststore.secretNames }}
+      - name: {{ . }}
+        secret:
+          secretName: {{ . }}
+      {{- end }}
diff --git a/charts/cryostat/values.schema.json b/charts/cryostat/values.schema.json
@@ -258,6 +258,22 @@
                             }
                         }
                     }
+                },
+                "config": {
+                    "type": "object",
+                    "properties": {
+                        "tlsTruststore": {
+                            "type": "object",
+                            "properties": {
+                                "secretNames": {
+                                    "type": "array",
+                                    "description": "List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.",
+                                    "default": [],
+                                    "items": {}
+                                }
+                            }
+                        }
+                    }
                 }
             }
         },

diff --git a/charts/cryostat/values.yaml b/charts/cryostat/values.yaml
@@ -85,6 +85,10 @@ core:
       builtInPortNumbersDisabled: false
       ## @param core.discovery.kubernetes.portNumbers [array] List of port numbers that the Cryostat application should look for in order to consider a target as JMX connectable
       portNumbers: []
+  config:
+    tlsTruststore:
+      ## @param core.config.tlsTruststore.secretNames [array] List of Secret names. Each Secret is expected to contain one or more files, which are TLS certificates which target applications may use for their JMX servers, to be mounted to the Cryostat container for its TLS truststore.
+      secretNames: []
 
 ## @section Report Generator Deployment
 ## @extra reports Configuration for the Reports Generator deployment