feat: add support for multiple CA bundles to helm

deansheather · deansheather · commit 5e2a75c41f13 · 2022-10-19T21:27:45.000Z
diff --git a/helm/templates/_helpers.tpl b/helm/templates/_helpers.tpl
@@ -91,6 +91,11 @@ Coder volume definitions.
   secret:
     secretName: {{ $secretName | quote }}
 {{ end -}}
+{{ range $secret := .Values.coder.certs.secrets -}}
+- name: "ca-cert-{{ $secret.name }}"
+  secret:
+    secretName: {{ $secret.name | quote }}
+{{ end -}}
 {{- end }}
 
 {{/*
@@ -113,7 +118,13 @@ Coder volume mounts.
 - name: "tls-{{ $secretName }}"
   mountPath: "/etc/ssl/certs/coder/{{ $secretName }}"
   readOnly: true
-{{ end }}
+{{ end -}}
+{{ range $secret := .Values.coder.certs.secrets -}}
+- name: "ca-cert-{{ $secret.name }}"
+  mountPath: "/etc/ssl/certs/{{ $secret.name }}.crt"
+  subPath: {{ $secret.key | quote }}
+  readOnly: true
+{{ end -}}
 {{- end }}
 
 {{/*
diff --git a/helm/values.yaml b/helm/values.yaml
@@ -65,12 +65,17 @@ coder:
     #   cpu: 100m
     #   memory: 128Mi
 
-  # coder.certs -- Certificate to mount inside the Coder pod (e.g. CA bundle).
+  # coder.certs -- CA bundles to mount inside the Coder pod.
   certs:
-    # coder.certs.secretNames -- A list of CA certificate secrets to mount into
-    # the Coder pod. The secrets should exist in the same namespace as the Helm
+    # coder.certs.secrets -- A list of CA bundle secrets to mount into the Coder
+    # pod. The secrets should exist in the same namespace as the Helm
     # deployment.
-    secretNames: []
+    #
+    # The given key in each secret is mounted at
+    # `/etc/ssl/certs/{secret_name}.crt`.
+    secrets: []
+      # - name: "my-ca-bundle"
+      #   key: "ca-bundle.crt"
 
   # coder.service -- The Service object to expose for Coder.
   service:
