feat: use custom CAs for mounting data connectors

DCACHE.md

@@ -0,0 +1,4 @@
+Temporary file, documents how to allow data connectors to connect to a specific dCache instance.
+
+URL: https://dcache.cta.cscs.ch:2880/
+Current URL to download the corresponding CA: https://dist.eugridpma.info/distribution/igtf/1.138/accredited/tgz/ca_emigtfc5r1-1.138.tar.gz

helm-chart/renku/requirements.yaml

@@ -19,8 +19,10 @@ dependencies:
     version: "0.3.9-renku-2"
     condition: notebooks.cloudstorage.s3.installDatashim
   - name: csi-rclone
-    repository: "https://swissdatasciencecenter.github.io/helm-charts/"
-    version: "0.6.0"
+    # repository: "https://swissdatasciencecenter.github.io/helm-charts/"
+    # version: "0.6.0"
+    repository: "oci://ghcr.io/swissdatasciencecenter/csi-rclone/helm-charts-dev"
+    version: "0.7.0-0.dev.git.156.h5342da0"
     condition: global.csi-rclone.install
   - name: solr
     repository: "oci://harbor.renkulab.io/bitnami-mirror"

helm-chart/renku/templates/_certificates-volumes.tpl

@@ -19,3 +19,32 @@
     {{- end -}}
     {{- end -}}
 {{- end -}}
+
+{{- define "certificatesForMounts.volumes" -}}
+{{- $customCAsEnabled := .Values.global.certificates.customCAs -}}
+{{- $customCAsForMountsEnabled := .Values.global.certificates.customCAsForDataConnectorMounts -}}
+- name: etc-ssl-certs
+  emptyDir:
+    medium: "Memory"
+- name: custom-ca-certs
+  projected:
+    defaultMode: 0444
+    sources:
+      - secret:
+          name: {{ include "renku.CASecretName" . }}
+          items:
+            - key: tls.crt
+              path: {{ include "renku.CASecretName" . }}-internal-communication-ca.crt
+    {{- if $customCAsEnabled }}
+    {{- range $customCA := .Values.global.certificates.customCAs }}
+      - secret:
+          name: {{ $customCA.secret }}
+    {{- end -}}
+    {{- end -}}
+    {{- if $customCAsForMountsEnabled }}
+    {{- range $customCA := .Values.global.certificates.customCAsForDataConnectorMounts }}
+      - secret:
+          name: {{ $customCA.secret }}
+    {{- end -}}
+    {{- end -}}
+{{- end -}}

helm-chart/renku/templates/data-service/deployment.yaml

@@ -287,5 +287,5 @@ spec:
           secret:
             secretName: {{ .Values.dataService.remoteClustersKubeconfigSecretName }}
         {{- end }}
-        {{- include "certificates.volumes" . | nindent 8 }}
+        {{- include "certificatesForMounts.volumes" . | nindent 8 }}
       serviceAccountName: {{ template "renku.fullname" . }}-data-service

helm-chart/renku/values.yaml

@@ -146,6 +146,8 @@ global:
       tag: "0.0.2"
     customCAs: []
     # - secret:
+    customCAsForDataConnectorMounts: []
+    # - secret:
   ## Database credentials for postgres
   db:
     ## Used by the renku-data-services and potentially other backend services