feat: add support for mysql_config_sslcapath option

opendatahub-io · Feb 17, 2024 · b80026c · b80026c
1 parent a49bfce
commit b80026c
Show file tree

Hide file tree

Showing 4 changed files with 35 additions and 8 deletions.
diff --git a/api/v1alpha1/modelregistry_types.go b/api/v1alpha1/modelregistry_types.go
@@ -122,8 +122,11 @@ type MySQLConfig struct {
 	// client private key.
 	SSLKeySecret *SecretKeyValue `json:"sslKeySecret,omitempty"`
 	// This parameter specifies the Kubernetes Secret name and key containing
-	// certificate authority (CA) certificate(s).
+	// certificate authority (CA) certificate.
 	SSLRootCertificateSecret *SecretKeyValue `json:"sslRootCertificateSecret,omitempty"`
+	// This parameter specifies the Kubernetes Secret name containing
+	// multiple certificate authority (CA) certificate(s) as keys.
+	SSLRootCertificatesSecretName *string `json:"sslRootCertificatesSecretName,omitempty"`
 	// This parameter specifies the list of permissible ciphers for SSL encryption.
 	SSLCipher *string `json:"sslCipher,omitempty"`
 	// If set, enable verification of the server certificate against the host

diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/config/crd/bases/modelregistry.opendatahub.io_modelregistries.yaml b/config/crd/bases/modelregistry.opendatahub.io_modelregistries.yaml
@@ -187,7 +187,7 @@ spec:
                     type: object
                   sslRootCertificateSecret:
                     description: This parameter specifies the Kubernetes Secret name
-                      and key containing certificate authority (CA) certificate(s).
+                      and key containing certificate authority (CA) certificate.
                     properties:
                       key:
                         description: Key name in secret
@@ -199,6 +199,11 @@ spec:
                     - key
                     - name
                     type: object
+                  sslRootCertificatesSecretName:
+                    description: This parameter specifies the Kubernetes Secret name
+                      containing multiple certificate authority (CA) certificate(s)
+                      as keys.
+                    type: string
                   username:
                     description: The MYSQL login id.
                     type: string

diff --git a/internal/controller/config/templates/deployment.yaml.tmpl b/internal/controller/config/templates/deployment.yaml.tmpl
@@ -72,6 +72,9 @@ spec:
                 {{- end}}
                 {{- if .Spec.MySQL.SSLRootCertificateSecret}}
             - --mysql_config_sslrootcert=/etc/mysql_ssl_rootcert/{{.Spec.MySQL.SSLRootCertificateSecret.Key}}
+                {{- end}}
+                {{- if .Spec.MySQL.SSLRootCertificatesSecretName}}
+            - --mysql_config_sslcapath=/etc/mysql_ssl_rootcerts/
                 {{- end}}
                 {{- if .Spec.MySQL.SSLCipher}}
             - --mysql_config_sslcipher={{.Spec.MySQL.SSLCipher}}
@@ -128,18 +131,23 @@ spec:
             {{- else if .Spec.MySQL}}
                 {{- if .Spec.MySQL.SSLCertificateSecret}}
             - name: mysql-ssl-cert
-            mountPath: /etc/mysql_ssl_cert
-            readOnly: true
+              mountPath: /etc/mysql_ssl_cert
+              readOnly: true
                 {{- end}}
                 {{- if .Spec.MySQL.SSLKeySecret}}
             - name: mysql-ssl-key
-            mountPath: /etc/mysql_ssl_key
-            readOnly: true
+              mountPath: /etc/mysql_ssl_key
+              readOnly: true
                 {{- end}}
                 {{- if .Spec.MySQL.SSLRootCertificateSecret}}
             - name: mysql-ssl-rootcert
-            mountPath: /etc/mysql_ssl_rootcert
-            readOnly: true
+              mountPath: /etc/mysql_ssl_rootcert
+              readOnly: true
+                {{- end}}
+                {{- if .Spec.MySQL.SSLRootCertificatesSecretName}}
+            - name: mysql-ssl-rootcerts
+              mountPath: /etc/mysql_ssl_rootcerts
+              readOnly: true
                 {{- end}}
             {{- end}}
           image: {{.Spec.Grpc.Image}}
@@ -246,4 +254,10 @@ spec:
             secretName: {{.Spec.MySQL.SSLRootCertificateSecret.Name}}
             defaultMode: 0600
             {{- end}}
+            {{- if .Spec.MySQL.SSLRootCertificatesSecretName}}
+        - name: mysql-ssl-rootcerts
+          secret:
+            secretName: {{.Spec.MySQL.SSLRootCertificatesSecretName}}
+            defaultMode: 0600
+            {{- end}}
         {{- end}}