feat: Add support to pull CA Certs from configMap

charts/operator-wandb/Chart.lock

@@ -42,4 +42,4 @@ dependencies:
   repository: file://charts/yace
   version: 0.1.0
 digest: sha256:bca2b6781737da6806e4485605cf9ce87b1428944b14cb88f082024cc3500bbd
-generated: "2024-10-09T17:53:33.992+05:30"
+generated: "2024-11-08T13:07:42.344971+05:30"

charts/operator-wandb/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: operator-wandb
 description: A Helm chart for deploying W&B to Kubernetes
 type: application
-version: 0.18.14
+version: 0.18.15
 appVersion: 1.0.0
 icon: https://wandb.ai/logo.svg
 

charts/operator-wandb/charts/app/templates/_deployment.tpl

@@ -73,11 +73,17 @@ spec:
               mountPath: /etc/ssl/certs/redis_ca.pem
               subPath: redis_ca.pem
             {{- end }}
+            {{- if .Values.global.caCertsConfigMap }}
+            - name: wandb-ca-certs-user
+              mountPath: /usr/local/share/ca-certificates/
+            {{- end }}
+            {{- if .Values.global.customCACerts }}
             {{- range $index, $v := .Values.global.customCACerts }}
             - name: wandb-ca-certs
               mountPath: /usr/local/share/ca-certificates/customCA{{$index}}.crt
               subPath: customCA{{$index}}.crt
             {{- end }}
+            {{- end }}
           ports:
             - name: http
               containerPort: 8080
@@ -300,9 +306,14 @@ spec:
               - key: REDIS_CA_CERT
                 path: redis_ca.pem
         {{- end }}
+        {{- if .Values.global.caCertsConfigMap }}
+        - name: wandb-ca-certs-user
+          configMap:
+            name: {{ .Values.global.caCertsConfigMap }}
+        {{- end }}
         {{- if .Values.global.customCACerts }}
         - name: wandb-ca-certs
           configMap:
             name: {{ include "wandb.fullname" . }}-ca-certs
         {{- end }}
-{{- end }}
+{{- end }}

charts/operator-wandb/charts/parquet/templates/configmap.yaml

@@ -0,0 +1,15 @@
+{{- if .Values.global.customCACerts }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "parquet.fullname" . }}-ca-certs
+  labels:
+    {{- include "wandb.labels" . | nindent 4 }}
+data:
+  {{- range $index, $pem := .Values.global.customCACerts }}
+  customCA{{$index}}.crt: |-
+    {{- range splitList "\n" $pem }}
+    {{ . }}
+    {{- end }}
+  {{- end }}
+{{- end }}

charts/operator-wandb/charts/parquet/templates/deployment.yaml

@@ -52,6 +52,17 @@ spec:
               mountPath: /etc/ssl/certs/redis_ca.pem
               subPath: redis_ca.pem
             {{- end }}
+            {{- if .Values.global.caCertsConfigMap }}
+            - name: wandb-ca-certs-user
+              mountPath: /usr/local/share/ca-certificates/
+            {{- end }}
+            {{- if .Values.global.customCACerts }}
+            {{- range $index, $v := .Values.global.customCACerts }}
+            - name: wandb-ca-certs
+              mountPath: /usr/local/share/ca-certificates/customCA{{$index}}.crt
+              subPath: customCA{{$index}}.crt
+            {{- end }}
+            {{- end }}
           ports:
             - name: parquet
               containerPort: 8087
@@ -154,4 +165,14 @@ spec:
               - key: REDIS_CA_CERT
                 path: redis_ca.pem
         {{- end }}
+        {{- if .Values.global.caCertsConfigMap }}
+        - name: wandb-ca-certs-user
+          configMap:
+            name: {{ .Values.global.caCertsConfigMap }}
+        {{- end }}
+        {{- if .Values.global.customCACerts }}
+        - name: wandb-ca-certs
+          configMap:
+            name: {{ include "parquet.fullname" . }}-ca-certs
+        {{- end }}
 {{- end }}

charts/operator-wandb/values.yaml

@@ -129,7 +129,19 @@ global:
     # If the topic already exists then changing the number of partitions is not possible.
     runUpdatesShadowNumPartitions: 12
 
+# To provide custom CA certificates, you can use either:
+# 1. `customCACerts`: a list of certificates provided directly within this Helm chart.
+# 2. `configMapName`: the name of a ConfigMap containing CA certificates.
+#
+# Important:
+# - If using a ConfigMap, each key in the ConfigMap must end with `.crt` (e.g., `my-cert.crt`).
+# - This naming convention is required for `update-ca-certificates` to parse and add each
+#   certificate to the system CA store on Ubuntu-based systems.
+
+# List of custom CA certificates in PEM format.
   customCACerts: []
+# Name of a ConfigMap containing additional .crt files for CA certificates.
+  caCertsConfigMap: ""
 
   weave-trace:
     enabled: false