From 9d9a446464cf83b97035a848f38da9dcb96060f5 Mon Sep 17 00:00:00 2001
From: Noste <83548733+Noooste@users.noreply.github.com>
Date: Fri, 7 Aug 2026 16:36:54 +0200
Subject: [PATCH] feat(deployment): add support for custom CA certificates and
 extra volumes in Helm chart

---
 helm/garage-ui/README.md                 | 32 ++++++++++++++++++++++++
 helm/garage-ui/templates/deployment.yaml |  6 +++++
 helm/garage-ui/values.schema.json        | 20 +++++++++++++++
 helm/garage-ui/values.yaml               |  6 +++++
 4 files changed, 64 insertions(+)

diff --git a/helm/garage-ui/README.md b/helm/garage-ui/README.md
index 76f7dce..a8e9386 100644
--- a/helm/garage-ui/README.md
+++ b/helm/garage-ui/README.md
@@ -351,6 +351,38 @@ affinity:
           topologyKey: kubernetes.io/hostname
 ```
 
+#### Custom CA Certificate
+
+If your OIDC provider or Garage endpoint uses a certificate signed by a private CA, mount the CA and point `SSL_CERT_FILE` at it instead of setting `tls_skip_verify: true`. Publicly trusted CAs remain trusted.
+
+```yaml
+extraObjects:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: garage-ui-ca
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        ...
+        -----END CERTIFICATE-----
+
+extraVolumes:
+  - name: ca-cert
+    configMap:
+      name: garage-ui-ca
+
+extraVolumeMounts:
+  - name: ca-cert
+    mountPath: /etc/garage-ui/certs/ca.crt
+    subPath: ca.crt
+    readOnly: true
+
+extraEnvs:
+  - name: SSL_CERT_FILE
+    value: /etc/garage-ui/certs/ca.crt
+```
+
 ### Complete Parameters Reference
 
 For a complete list of all available parameters, see the [values.yaml](values.yaml) file which includes detailed comments for every configuration option.
diff --git a/helm/garage-ui/templates/deployment.yaml b/helm/garage-ui/templates/deployment.yaml
index 47c24a5..e94dca0 100644
--- a/helm/garage-ui/templates/deployment.yaml
+++ b/helm/garage-ui/templates/deployment.yaml
@@ -111,10 +111,16 @@ spec:
           mountPath: /app/config.yaml
           subPath: config.yaml
           readOnly: true
+        {{- with .Values.extraVolumeMounts }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
       volumes:
       - name: config
         configMap:
           name: {{ include "garage-ui.fullname" . }}-config
+      {{- with .Values.extraVolumes }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
diff --git a/helm/garage-ui/values.schema.json b/helm/garage-ui/values.schema.json
index 3533f15..7f8a7ed 100644
--- a/helm/garage-ui/values.schema.json
+++ b/helm/garage-ui/values.schema.json
@@ -57,6 +57,26 @@
       "description": "Override the full resource name (includes release name)",
       "default": ""
     },
+    "extraEnvs": {
+      "type": "array",
+      "description": "Extra environment variables for the garage-ui container",
+      "default": []
+    },
+    "extraObjects": {
+      "type": "array",
+      "description": "Extra Kubernetes manifests to deploy alongside the chart (rendered through tpl)",
+      "default": []
+    },
+    "extraVolumes": {
+      "type": "array",
+      "description": "Extra volumes for the pod (e.g. a custom CA certificate ConfigMap)",
+      "default": []
+    },
+    "extraVolumeMounts": {
+      "type": "array",
+      "description": "Extra volume mounts for the garage-ui container",
+      "default": []
+    },
     "config": {
       "type": "object",
       "description": "Main application configuration",
diff --git a/helm/garage-ui/values.yaml b/helm/garage-ui/values.yaml
index b1c66e4..a21c11f 100644
--- a/helm/garage-ui/values.yaml
+++ b/helm/garage-ui/values.yaml
@@ -14,6 +14,12 @@ fullnameOverride: ""
 
 extraEnvs: []
 
+# Extra volumes for the pod (e.g. a custom CA certificate ConfigMap)
+extraVolumes: []
+
+# Extra volume mounts for the garage-ui container
+extraVolumeMounts: []
+
 # Extra Kubernetes manifests to deploy alongside the chart.
 # Each entry is rendered through `tpl`, so Helm templating is supported.
 # Useful for ExternalSecret, HTTPRoute, CiliumNetworkPolicy, etc.