diff --git a/charts/library/common-test/Chart.yaml b/charts/library/common-test/Chart.yaml index 4d01967c83c..ecb6fb07034 100644 --- a/charts/library/common-test/Chart.yaml +++ b/charts/library/common-test/Chart.yaml @@ -37,4 +37,3 @@ sources: - https://github.com/trueforge-org/truecharts/tree/master/charts/library/common-test type: application version: 1.0.0 - diff --git a/charts/library/common-test/tests/volsync/replication_dest_spec_test.yaml b/charts/library/common-test/tests/volsync/replication_dest_spec_test.yaml index 680f0223e00..3391e3c7184 100644 --- a/charts/library/common-test/tests/volsync/replication_dest_spec_test.yaml +++ b/charts/library/common-test/tests/volsync/replication_dest_spec_test.yaml @@ -350,3 +350,78 @@ tests: fsGroup: 568 runAsUser: 568 runAsGroup: 568 + + - it: should generate correct spec with customCA + set: + persistence: + destbackup: + enabled: true + type: pvc + mountPath: /backedup + volsync: + - name: mybackup1 + type: restic + credentials: mys3 + dest: + enabled: true + src: + enabled: false + credentials: + mys3: + type: s3 + url: https://s3.some-url + bucket: some-bucket + encrKey: some-key + accessKey: some-access-key + secretKey: some-secret-key + customCA: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + asserts: + - documentIndex: &secretCaDoc 1 + isKind: + of: Secret + - documentIndex: *secretCaDoc + isAPIVersion: + of: v1 + - documentIndex: *secretCaDoc + equal: + path: metadata.name + value: test-release-name-common-test-volsync-ca-mys3 + - documentIndex: *secretCaDoc + equal: + path: stringData + value: + ca.crt: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + - documentIndex: &replicationCaDestDoc 2 + isKind: + of: ReplicationDestination + - documentIndex: *replicationCaDestDoc + isAPIVersion: + of: volsync.backube/v1alpha1 + - documentIndex: *replicationCaDestDoc + equal: + path: spec + value: + trigger: + manual: restore-once + restic: + repository: test-release-name-common-test-destbackup-volsync-mybackup1 + customCA: + secretName: test-release-name-common-test-volsync-ca-mys3 + key: ca.crt + copyMethod: Snapshot + cleanupTempPVC: false + cleanupCachePVC: false + cacheCapacity: 10Gi + capacity: 100Gi + accessModes: + - ReadWriteOnce + moverSecurityContext: + fsGroup: 568 + runAsUser: 568 + runAsGroup: 568 diff --git a/charts/library/common-test/tests/volsync/replication_src_spec_test.yaml b/charts/library/common-test/tests/volsync/replication_src_spec_test.yaml index 6290bbfb503..63b2a185b29 100644 --- a/charts/library/common-test/tests/volsync/replication_src_spec_test.yaml +++ b/charts/library/common-test/tests/volsync/replication_src_spec_test.yaml @@ -339,3 +339,89 @@ tests: matchRegex: path: spec.restic.unlock pattern: "^[0-9]{14}$" + + - it: should generate correct spec with customCA + set: + persistence: + srcbackup: + enabled: true + type: pvc + mountPath: /backedup + volsync: + - name: mybackup1 + type: restic + credentials: mys3 + dest: + enabled: false + src: + enabled: true + credentials: + mys3: + type: s3 + url: http://some-url + bucket: some-bucket + encrKey: some-key + accessKey: some-access-key + secretKey: some-secret-key + customCA: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + asserts: + - documentIndex: &secretCaDoc 1 + isKind: + of: Secret + - documentIndex: *secretCaDoc + isAPIVersion: + of: v1 + - documentIndex: *secretCaDoc + equal: + path: metadata.name + value: test-release-name-common-test-volsync-ca-mys3 + - documentIndex: *secretCaDoc + equal: + path: stringData + value: + ca.crt: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- + - documentIndex: &replicationCaDestDoc 2 + isKind: + of: ReplicationSource + - documentIndex: *replicationCaDestDoc + isAPIVersion: + of: volsync.backube/v1alpha1 + - documentIndex: *replicationCaDestDoc + isSubset: + path: spec + content: + sourcePVC: test-release-name-common-test-srcbackup + trigger: + schedule: "0 0 * * *" + - documentIndex: *replicationCaDestDoc + isSubset: + path: spec.restic + content: + repository: test-release-name-common-test-srcbackup-volsync-mybackup1 + customCA: + secretName: test-release-name-common-test-volsync-ca-mys3 + key: ca.crt + copyMethod: Snapshot + pruneIntervalDays: 7 + retain: + hourly: 6 + daily: 5 + weekly: 4 + monthly: 3 + yearly: 1 + accessModes: + - ReadWriteOnce + moverSecurityContext: + fsGroup: 568 + runAsUser: 568 + runAsGroup: 568 + - documentIndex: *replicationCaDestDoc + matchRegex: + path: spec.restic.unlock + pattern: "^[0-9]{14}$" diff --git a/charts/library/common/Chart.yaml b/charts/library/common/Chart.yaml index 0b319952670..06b0cc6dafa 100644 --- a/charts/library/common/Chart.yaml +++ b/charts/library/common/Chart.yaml @@ -50,5 +50,4 @@ sources: - https://hub.docker.com/_/ - https://hub.docker.com/r/mikefarah/yq type: library -version: 28.20.1 - +version: 28.21.0 diff --git a/charts/library/common/templates/class/volsync/_replicationDestination.tpl b/charts/library/common/templates/class/volsync/_replicationDestination.tpl index 7ca2322c411..70ffd895a4c 100644 --- a/charts/library/common/templates/class/volsync/_replicationDestination.tpl +++ b/charts/library/common/templates/class/volsync/_replicationDestination.tpl @@ -55,6 +55,11 @@ spec: manual: restore-once {{ $volsyncData.type }}: repository: {{ $volsyncData.repository }} + {{- if $volsyncData.customCA }} + customCA: + secretName: {{ $volsyncData.customCA }} + key: ca.crt + {{- end }} copyMethod: {{ $copyMethod }} capacity: {{ $capacity }} {{- if eq $copyMethod "Direct" }} diff --git a/charts/library/common/templates/class/volsync/_replicationSource.tpl b/charts/library/common/templates/class/volsync/_replicationSource.tpl index 725576aabcf..0403d21f21b 100644 --- a/charts/library/common/templates/class/volsync/_replicationSource.tpl +++ b/charts/library/common/templates/class/volsync/_replicationSource.tpl @@ -53,6 +53,11 @@ spec: schedule: {{ $schedule }} {{ $volsyncData.type }}: repository: {{ $volsyncData.repository }} + {{- if $volsyncData.customCA }} + customCA: + secretName: {{ $volsyncData.customCA }} + key: ca.crt + {{- end }} copyMethod: {{ $volsyncData.copyMethod | default "Snapshot" }} pruneIntervalDays: {{ $volsyncData.src.pruneIntervalDays | default 7 }} unlock: {{ now | date "20060102150405" | quote }} diff --git a/charts/library/common/templates/spawner/_pvc.tpl b/charts/library/common/templates/spawner/_pvc.tpl index b4b3b060b4d..a0a67b113cc 100644 --- a/charts/library/common/templates/spawner/_pvc.tpl +++ b/charts/library/common/templates/spawner/_pvc.tpl @@ -128,6 +128,25 @@ ) -}} {{- include "tc.v1.common.class.secret" (dict "rootCtx" $ "objectData" $volsyncSecretData) -}} + + {{/* Create Custom CA Secret for VolSync */}} + {{- if $credentials.customCA -}} + {{- $volsyncCASecretName := printf "%s-volsync-ca-%s" (include "tc.v1.common.lib.chart.names.fullname" $ ) $volsync.credentials -}} + + {{- $_ := set $volsyncData "customCA" $volsyncCASecretName -}} + + {{- $volsyncCASecretData := (dict + "name" $volsyncCASecretName + "labels" ($volsync.labels | default dict) + "annotations" ($volsync.annotations | default dict) + "data" (dict + "ca.crt" $credentials.customCA + ) + ) -}} + + {{- include "tc.v1.common.class.secret" (dict "rootCtx" $ "objectData" $volsyncCASecretData) -}} + {{- end -}} + {{/* Create VolSync resources*/}} {{- if $srcEnabled -}} {{- include "tc.v1.common.class.replicationsource" (dict "rootCtx" $ "objectData" $objectData "volsyncData" $volsyncData) -}} diff --git a/charts/library/common/values.yaml b/charts/library/common/values.yaml index cbfd0b68e1f..76a0bd40626 100644 --- a/charts/library/common/values.yaml +++ b/charts/library/common/values.yaml @@ -282,6 +282,9 @@ credentials: # mys3: # type: s3 # url: "" + # ## Provide a custom certificate authority in cases where the URL endpoint + # ## uses a self-signed certificate + # customCA: "" # path: "" # bucket: "" # accessKey: "" diff --git a/website/src/content/docs/common/credentials.md b/website/src/content/docs/common/credentials.md index f16714706de..df0ac644c87 100644 --- a/website/src/content/docs/common/credentials.md +++ b/website/src/content/docs/common/credentials.md @@ -106,6 +106,30 @@ credentials: --- +#### `customCA` + +Define a custom CA certificate to be used when connecting to the endpoint +defined by `url` over HTTPS. + +| | | +| ---------- | ------------------------------------------------------------- | +| Key | `credentials.$name.customCA` | +| Type | `string` | +| Required | ❌ | +| Helm `tpl` | ❌ | +| Example | `-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----` | + +```yaml +credentials: + credentials-name: + customCA: |- + -----BEGIN CERTIFICATE----- + ... + -----END CERTIFICATE----- +``` + +--- + #### `path` Define the optional path-override of the credentials