diff options
| author | Nikolay Govorov <me@govorov.online> | 2026-08-24 01:32:55 +0100 |
|---|---|---|
| committer | Nikolay Govorov <me@govorov.online> | 2026-08-24 01:32:55 +0100 |
| commit | 1446e1b8b9d64b8c620c0f080b805235e50d58f5 (patch) | |
| tree | 3568688bff98513a194c2024a602a8f1ed2611ae | |
| parent | 790069ad390e143166d5e0f9d3cbdcaacdd03442 (diff) | |
| download | tar tar.gz tar.bz2 tar.lz tar.xz tar.zst zip | |
Supports mtls for postgres
Diffstat
| -rw-r--r-- | charts/mirum/templates/server-deployment.yaml | 29 | +29 −0 |
| -rw-r--r-- | charts/mirum/values.yaml | 15 | +15 −0 |
2 files changed, 44 insertions, 0 deletions
diff --git a/charts/mirum/templates/server-deployment.yaml b/charts/mirum/templates/server-deployment.yaml index 82df4b0..9191159 100644 --- a/charts/mirum/templates/server-deployment.yaml +++ b/charts/mirum/templates/server-deployment.yaml @@ -4,6 +4,9 @@ {{- if and .Values.server.enabled (ne (int .Values.server.replicaCount) 1) }} {{- fail "mirum: server.replicaCount must be 1 while the task queue is process-local" }} {{- end }} +{{- if and .Values.server.enabled .Values.server.postgresqlMtls.enabled (not .Values.server.serviceAccountName) }} +{{- fail "mirum: server.serviceAccountName is required when server.postgresqlMtls.enabled=true" }} +{{- end }} {{- if .Values.server.enabled }} apiVersion: apps/v1 kind: Deployment @@ -31,6 +34,9 @@ spec: {{- end }} spec: automountServiceAccountToken: false + {{- with .Values.server.serviceAccountName }} + serviceAccountName: {{ . | quote }} + {{- end }} terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} securityContext: runAsNonRoot: true @@ -81,6 +87,11 @@ spec: mountPath: /etc/mirum/grpc-tls readOnly: true {{- end }} + {{- if .Values.server.postgresqlMtls.enabled }} + - name: postgresql-tls + mountPath: {{ .Values.server.postgresqlMtls.mountPath }} + readOnly: true + {{- end }} - name: run mountPath: /run/mirum-server volumes: @@ -94,6 +105,24 @@ spec: secretName: {{ . }} defaultMode: 0440 {{- end }} + {{- if .Values.server.postgresqlMtls.enabled }} + - name: postgresql-tls + csi: + driver: csi.cert-manager.io + readOnly: true + volumeAttributes: + csi.cert-manager.io/issuer-name: {{ required "mirum: server.postgresqlMtls.issuerName is required" .Values.server.postgresqlMtls.issuerName | quote }} + csi.cert-manager.io/issuer-kind: {{ .Values.server.postgresqlMtls.issuerKind | quote }} + csi.cert-manager.io/common-name: {{ required "mirum: server.postgresqlMtls.commonName is required" .Values.server.postgresqlMtls.commonName | quote }} + csi.cert-manager.io/uri-sans: {{ .Values.server.postgresqlMtls.uriSan | quote }} + csi.cert-manager.io/key-algorithm: "ECDSA" + csi.cert-manager.io/key-size: "256" + csi.cert-manager.io/key-encoding: "PKCS8" + csi.cert-manager.io/key-usages: "digital signature,client auth" + csi.cert-manager.io/duration: {{ .Values.server.postgresqlMtls.duration | quote }} + csi.cert-manager.io/renew-before: {{ .Values.server.postgresqlMtls.renewBefore | quote }} + csi.cert-manager.io/fs-group: {{ .Values.server.postgresqlMtls.fsGroup | quote }} + {{- end }} - name: run emptyDir: {} {{- with .Values.server.nodeSelector }} diff --git a/charts/mirum/values.yaml b/charts/mirum/values.yaml index 13158a2..f51ae16 100644 --- a/charts/mirum/values.yaml +++ b/charts/mirum/values.yaml @@ -17,6 +17,21 @@ server: # certificate. Keep database_uri, pepper, token, and webhook_secret in this # Secret rather than Helm values. existingSecret: mirum-server + # Optional existing ServiceAccount used by the server. The default empty + # value preserves the current Deployment and external database path. + serviceAccountName: "" + postgresqlMtls: + # Opt-in client-certificate mount for passwordless PostgreSQL mTLS. Disabled + # by default; no CSI resources or volume mounts are rendered unless enabled. + enabled: false + mountPath: /etc/mirum/postgresql-tls + issuerName: "" + issuerKind: ClusterIssuer + commonName: "" + uriSan: "spiffe://ddlabs.internal/ns/${POD_NAMESPACE}/sa/${SERVICE_ACCOUNT_NAME}/pod/${POD_UID}" + duration: 2160h + renewBefore: 360h + fsGroup: 10000 grpcTls: # Optional cert-manager-style Secret containing tls.crt and tls.key. The # files are mounted at /etc/mirum/grpc-tls/ for config.yaml to reference. |