IDP-1416 Add support for workleap certificate store

charts/aspnetcore/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: aspnetcore
 description: A generic Helm chart for ASP.NET Core services
-version: 1.0.4
+version: 1.0.5
 home: https://github.com/gsoft-inc/gsoft-helm-charts
 sources:
   - https://github.com/gsoft-inc/gsoft-helm-charts

charts/aspnetcore/templates/deployment.yaml

@@ -35,9 +35,6 @@ spec:
       {{- end }}
     spec:
       serviceAccountName: {{ include "aspnetcore.serviceAccountName" . }}
-      {{- if .Values.volumes }}
-        {{- toYaml .Values.volumes | nindent 6 }}
-      {{- end }}
       containers:
         - name: {{ .Chart.Name }}-container
           image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag }}"
@@ -68,8 +65,14 @@ spec:
           startupProbe:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if .Values.extraVolumeMounts }}
           volumeMounts:
+          {{- if .Values.certificateStore.enabled }}
+          - name: internal-certificates
+            mountPath: "/etc/ssl/certs/ca-certificates.crt"
+            subPath: "certificate-wildcard-platform-workleap-{{ .Values.environment }}-internal"
+            readOnly: true
+          {{- end }}
+          {{- if .Values.extraVolumeMounts }}
             {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
           {{- end }}
       {{- with .Values.nodeSelector }}
@@ -84,7 +87,15 @@ spec:
       tolerations:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if .Values.extraVolumes}}
       volumes:
+      {{- if .Values.certificateStore.enabled }}
+      - name: internal-certificates
+        csi:
+          driver: secrets-store.csi.k8s.io
+          readOnly: true
+          volumeAttributes:
+            secretProviderClass: internal-dns-keyvault
+      {{- end }}
+      {{- if .Values.extraVolumes}}
         {{- toYaml .Values.extraVolumes | nindent 8 }}
       {{- end }}

charts/aspnetcore/templates/secretproviderclass.yaml

@@ -0,0 +1,18 @@
+{{- if .Values.certificateStore.enabled }}
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: internal-dns-keyvault
+spec:
+  provider: azure
+  parameters:
+    usePodIdentity: "false"       
+    clientID: {{ .Values.azureWorkloadIdentity.clientId }}
+    keyvaultName: {{ .Values.certificateStore.keyvaultName }}
+    objects:  |
+      array:
+        - |
+          objectName: INTERNAL_DNS_CERTIFICATE_NAME
+          objectType: cert
+    tenantId: {{ .Values.certificateStore.tenantId }}
+{{- end }}

charts/aspnetcore/values.yaml

@@ -180,3 +180,12 @@ extraVolumes: []
 ##     mountPath: /etc/config
 ##
 extraVolumeMounts: []
+
+## Replace the container's certificate store with Workleap's certificate store which is stored in an Azure Key Vault
+## @param certificateStore.enabled Whether or not to replace the container's certificate store with Workleap's
+## @param certificateStore.tenantId The id of the azure tenant the Key Vault containing the certificate store is located in
+## @param certificateStore.keyvaultName The name of the Key Vault containing the certificate store
+certificateStore:
+  enabled: false
+  tenantId: ""
+  keyvaultName: ""