feat(deployment): add support for custom CA certificates and extra volumes in Helm chart

helm/garage-ui/README.md

@@ -351,6 +351,38 @@ affinity:
           topologyKey: kubernetes.io/hostname
 ```
 
+#### Custom CA Certificate
+
+If your OIDC provider or Garage endpoint uses a certificate signed by a private CA, mount the CA and point `SSL_CERT_FILE` at it instead of setting `tls_skip_verify: true`. Publicly trusted CAs remain trusted.
+
+```yaml
+extraObjects:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: garage-ui-ca
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        ...
+        -----END CERTIFICATE-----
+
+extraVolumes:
+  - name: ca-cert
+    configMap:
+      name: garage-ui-ca
+
+extraVolumeMounts:
+  - name: ca-cert
+    mountPath: /etc/garage-ui/certs/ca.crt
+    subPath: ca.crt
+    readOnly: true
+
+extraEnvs:
+  - name: SSL_CERT_FILE
+    value: /etc/garage-ui/certs/ca.crt
+```
+
 ### Complete Parameters Reference
 
 For a complete list of all available parameters, see the [values.yaml](values.yaml) file which includes detailed comments for every configuration option.

helm/garage-ui/templates/deployment.yaml

@@ -111,10 +111,16 @@ spec:
           mountPath: /app/config.yaml
           subPath: config.yaml
           readOnly: true
+        {{- with .Values.extraVolumeMounts }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       volumes:
       - name: config
         configMap:
           name: {{ include "garage-ui.fullname" . }}-config
+      {{- with .Values.extraVolumes }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

helm/garage-ui/values.schema.json

@@ -57,6 +57,26 @@
       "description": "Override the full resource name (includes release name)",
       "default": ""
     },
+    "extraEnvs": {
+      "type": "array",
+      "description": "Extra environment variables for the garage-ui container",
+      "default": []
+    },
+    "extraObjects": {
+      "type": "array",
+      "description": "Extra Kubernetes manifests to deploy alongside the chart (rendered through tpl)",
+      "default": []
+    },
+    "extraVolumes": {
+      "type": "array",
+      "description": "Extra volumes for the pod (e.g. a custom CA certificate ConfigMap)",
+      "default": []
+    },
+    "extraVolumeMounts": {
+      "type": "array",
+      "description": "Extra volume mounts for the garage-ui container",
+      "default": []
+    },
     "config": {
       "type": "object",
       "description": "Main application configuration",

helm/garage-ui/values.yaml

@@ -14,6 +14,12 @@ fullnameOverride: ""
 
 extraEnvs: []
 
+# Extra volumes for the pod (e.g. a custom CA certificate ConfigMap)
+extraVolumes: []
+
+# Extra volume mounts for the garage-ui container
+extraVolumeMounts: []
+
 # Extra Kubernetes manifests to deploy alongside the chart.
 # Each entry is rendered through `tpl`, so Helm templating is supported.
 # Useful for ExternalSecret, HTTPRoute, CiliumNetworkPolicy, etc.