add privateCA config to registry service (#2078)

* add privateCA config to registry service * add env for privateCA config * update registry service test case
astronomer · Dec 28, 2023 · 212b420 · 212b420
1 parent 3e1468b
commit 212b420
Show file tree

Hide file tree

Showing 2 changed files with 33 additions and 0 deletions.
diff --git a/charts/astronomer/templates/registry/registry-statefulset.yaml b/charts/astronomer/templates/registry/registry-statefulset.yaml
@@ -76,6 +76,10 @@ spec:
             {{- else }}
             value: {{ randAlphaNum 32 }}
             {{- end }}
+          {{- if .Values.global.privateCaCerts }}
+          - name: UPDATE_CA_CERTS
+            value: "true"
+          {{- end }}
 {{- if .Values.registry.extraEnv }}
 {{ toYaml .Values.registry.extraEnv | indent 10 }}
 {{- end }}
@@ -91,6 +95,7 @@ spec:
             {{- if and .Values.registry.gcs.enabled .Values.registry.gcs.useKeyfile }}
             {{- include "registry.gcsVolumeMount" . | indent 12 }}
             {{- end }}
+            {{- include "custom_ca_volume_mounts" . | indent 12  }}
           ports:
             - name: registry-http
               containerPort: {{ .Values.ports.registryHTTP }}
@@ -127,6 +132,7 @@ spec:
         - name: data
           emptyDir: {}
   {{- else }}
+        {{ include "custom_ca_volumes" . | indent 8  }}
   volumeClaimTemplates:
     - metadata:
         name: data

diff --git a/tests/chart_tests/test_registry_statefulset.py b/tests/chart_tests/test_registry_statefulset.py
@@ -1,6 +1,7 @@
 from tests.chart_tests.helm_template_generator import render_chart
 import pytest
 from tests import supported_k8s_versions
+import jmespath
 
 
 @pytest.mark.parametrize(
@@ -117,3 +118,29 @@ def test_registry_sts_with_podlabels(self, kube_version):
 
         for k, v in labels.items():
             assert docs[0]["spec"]["template"]["metadata"]["labels"][k] == v
+
+    def test_registry_privateca_enabled(self, kube_version):
+        docs = render_chart(
+            kube_version=kube_version,
+            values={"global": {"privateCaCerts": ["private-root-ca"]}},
+            show_only=[
+                "charts/astronomer/templates/registry/registry-statefulset.yaml"
+            ],
+        )
+        search_result = jmespath.search(
+            "spec.template.spec.containers[*].volumeMounts[?name == 'private-root-ca']",
+            docs[0],
+        )
+        expected_result = [
+            [
+                {
+                    "mountPath": "/usr/local/share/ca-certificates/private-root-ca.pem",
+                    "name": "private-root-ca",
+                    "subPath": "cert.pem",
+                }
+            ]
+        ]
+        assert search_result == expected_result
+        assert {"name": "UPDATE_CA_CERTS", "value": "true"} in docs[0]["spec"][
+            "template"
+        ]["spec"]["containers"][0]["env"]