You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@devlake.apache.org by "GuillermoGarciaF (via GitHub)" <gi...@apache.org> on 2024/10/20 17:55:39 UTC

[PR] Enable option to add Volume, VolumeMount to devlake Deployment - critical for SSL certificate [incubator-devlake-helm-chart]

GuillermoGarciaF opened a new pull request, #311:
URL: https://github.com/apache/incubator-devlake-helm-chart/pull/311

   The devlake [Deployment](https://github.com/apache/incubator-devlake-helm-chart/blob/1b9a97f4a4c103d62c0f9a4ccdf9afc39b9c5307/charts/devlake/templates/deployments.yaml#L121) does not expose `Volumes`, `VolumeMounts`.
   
   These are required e.g. to mount a CA Certificate to establish a secure SSL connection.
   Our policies only allow SSL connections to Azure MySQL Server. I would love to contribute to Apache DevLAke and add the PR myself.
   
   There are several GH issues related to SSL and the current limitations
   - https://github.com/apache/incubator-devlake/issues/7928
   - https://github.com/apache/incubator-devlake/issues/8121
   
   See  #310


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enable option to add Volume, VolumeMount to devlake Deployment - critical for SSL certificate [incubator-devlake-helm-chart]

Posted by "GuillermoGarciaF (via GitHub)" <gi...@apache.org>.
GuillermoGarciaF commented on PR #311:
URL: https://github.com/apache/incubator-devlake-helm-chart/pull/311#issuecomment-2425734853

   Yes, I successfully tested the following helm-values:
   
   ```
   lake:
     volumeMounts:
       - name: azure-mysql-ca
         mountPath: /opt/argus/DigiCertGlobalRootCA.crt.pem
         subPath: DigiCertGlobalRootCA.crt.pem
         readOnly: true
     volumes:
       - name: azure-mysql-ca
         configMap:
           name: azure-mysql-ca
           items:
           - key: DigiCertGlobalRootCA.crt.pem
             path: DigiCertGlobalRootCA.crt.pem
   ```
   
   which result in the following pod manifest:
   
   -``volumes:`` section:
   ![Screenshot 2024-10-21 at 08 40 14](https://github.com/user-attachments/assets/2a16796a-58b6-44b4-83d1-a9bfe5cca33e)
   
   -``volumeMounts:`` section:
   ![Screenshot 2024-10-21 at 08 41 32](https://github.com/user-attachments/assets/33b54e2a-391a-402c-8a71-7a1faae13140)
   
   I also checked the certificate is correctly mounted in the container file system:
   ![Screenshot 2024-10-21 at 08 47 12](https://github.com/user-attachments/assets/ab06af3e-4626-43f8-b196-a005c23308d9)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enable option to add Volume, VolumeMount to devlake Deployment - critical for SSL certificate [incubator-devlake-helm-chart]

Posted by "GuillermoGarciaF (via GitHub)" <gi...@apache.org>.
GuillermoGarciaF commented on PR #311:
URL: https://github.com/apache/incubator-devlake-helm-chart/pull/311#issuecomment-2425153699

   CC: @abeizn @ZhangNing10 please review


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enable option to add Volume, VolumeMount to devlake Deployment - critical for SSL certificate [incubator-devlake-helm-chart]

Posted by "klesh (via GitHub)" <gi...@apache.org>.
klesh commented on PR #311:
URL: https://github.com/apache/incubator-devlake-helm-chart/pull/311#issuecomment-2425366557

    Nice work, have you tested it on your local env?


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enable option to add Volume, VolumeMount to devlake Deployment - critical for SSL certificate [incubator-devlake-helm-chart]

Posted by "klesh (via GitHub)" <gi...@apache.org>.
klesh merged PR #311:
URL: https://github.com/apache/incubator-devlake-helm-chart/pull/311


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Enable option to add Volume, VolumeMount to devlake Deployment - critical for SSL certificate [incubator-devlake-helm-chart]

Posted by "GuillermoGarciaF (via GitHub)" <gi...@apache.org>.
GuillermoGarciaF commented on PR #311:
URL: https://github.com/apache/incubator-devlake-helm-chart/pull/311#issuecomment-2425769144

   Finally, I confirmed the devlake container stablishes SSL connection when concatenating `&tls=custom&ca-cert=/opt/argus/DigiCertGlobalRootCA.crt.pem` in the `DB_URL` environment variable.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@devlake.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org