Make ttl changeable in the values file

charts/kasm/templates/api-deployment.yaml

@@ -39,6 +39,7 @@ spec:
         {{- with .Values.components.api.labels }}{{ toYaml . | nindent 8 }}{{- end }}
         {{- with .Values.extraLabels.pod }}{{ toYaml . | nindent 8 }}{{- end }}
         {{- with .Values.labels }}{{- toYaml . | nindent 8 }}{{- end }}
+        certs: trust-store
       {{- if or .Values.components.api.annotations .Values.annotations.pod }}
       annotations:
         {{- with .Values.annotations.pod }}{{ toYaml . | nindent 8 }}{{- end }}
@@ -59,6 +60,15 @@ spec:
       {{- with .Values.affinity }}
       affinity: {{ toYaml . | nindent 8 }}
       {{- end }}
+      volumes:
+        - name: uds-trust-bundle
+          configMap:
+            name: uds-trust-bundle
+            items:
+              - key: ca-bundle.pem
+                path: ca-bundle.pem
+        - name: combined-certs
+          emptyDir: {}
       initContainers:
         - name: db-is-ready
           image: {{ $constants.api.image }}
@@ -94,6 +104,22 @@ spec:
         - name: {{ $constants.api.name }}-container
           image: {{ $constants.api.image }}
           imagePullPolicy: {{ .Values.imagePullPolicy }}
+          command:
+            - "/bin/sh"
+            - "-c"
+            - |
+              echo "# Combined CA Bundle - System and UDS Certificates" > /opt/certs/combined-ca-bundle.pem
+              echo "" >> /opt/certs/combined-ca-bundle.pem
+              if [ -f /etc/ssl/certs/ca-certificates.crt ]; then
+                echo "# System CA Certificates" >> /opt/certs/combined-ca-bundle.pem
+                cat /etc/ssl/certs/ca-certificates.crt >> /opt/certs/combined-ca-bundle.pem
+                echo "" >> /opt/certs/combined-ca-bundle.pem
+              fi
+              if [ -f /etc/ssl/certs/uds-ca-bundle.pem ]; then
+                echo "# UDS Certificate Bundle" >> /opt/certs/combined-ca-bundle.pem
+                cat /etc/ssl/certs/uds-ca-bundle.pem >> /opt/certs/combined-ca-bundle.pem
+              fi
+              /usr/bin/startup.sh
           env:
             - name: START_SERVICES
               value: "true"
@@ -116,6 +142,10 @@ spec:
                   name: {{ .Release.Name }}-secrets
                   key: "db-password"
                 {{- end }}
+            - name: SSL_CERT_FILE
+              value: /opt/certs/combined-ca-bundle.pem
+            - name: REQUESTS_CA_BUNDLE
+              value: /opt/certs/combined-ca-bundle.pem
           ports:
             - name: {{ $constants.api.portName }}
               containerPort: {{ $constants.api.port }}
@@ -134,3 +164,10 @@ spec:
           {{- if .Values.applyPodSecurity }}
             {{- include "kasm.containerSecurity" . | indent 10 }}
           {{- end }}
+          volumeMounts:
+            - name: uds-trust-bundle
+              mountPath: /etc/ssl/certs/uds-ca-bundle.pem
+              readOnly: true
+              subPath: ca-bundle.pem
+            - mountPath: /opt/certs
+              name: combined-certs

charts/kasm/templates/db-init-job.yaml

@@ -19,7 +19,7 @@ metadata:
     helm.sh/hook: pre-install
   {{- end }}
 spec:
-  ttlSecondsAfterFinished: 100
+  ttlSecondsAfterFinished: {{ .Values.components.api.ttlBeforeDelete }}
   template:
     metadata:
       labels:
@@ -125,4 +125,4 @@ spec:
           args:
             - |
               if [[ "$DB_AUTO_INITIALIZE" == "true" ]]; then /usr/bin/startup.sh; else echo "DB already initialized."; fi
-{{- end }}
+{{- end }}

charts/kasm/values.schema.json

@@ -220,6 +220,12 @@
               "title": "labels",
               "type": "object"
             },
+            "ttlBeforeDelete": {
+              "additionalProperties": true,
+              "description": "Time to live setting for the db-init-job",
+              "title": "ttlBeforeDelete",
+              "type": "integer"
+            },
             "resources": {
               "additionalProperties": true,
               "description": "Manually configure the Kasm api Deployment resources. This overrides the pre-defined `deploymentSize` values.",
@@ -234,6 +240,7 @@
             "image",
             "resources",
             "annotations",
+	    "ttlBeforeDelete",
             "labels"
           ]
         },
@@ -1205,4 +1212,4 @@
     }
   },
   "type": "object"
-}
+}

charts/kasm/values.yaml

@@ -283,6 +283,8 @@ components:
     annotations: {}
     # components.api.resources -- Manually configure the Kasm api Deployment resources. This overrides the pre-defined `deploymentSize` values.
     resources: {}
+    # components.api.ttlBeforeDelete -- Time to live setting for the db-init-job
+    ttlBeforeDelete: 100
     # components.api.labels -- Custom labels to add to the Kasm api Deployment
     labels: {}
   # Configuration settings for the Kasm Manager service
@@ -485,4 +487,4 @@ extraLabels:
 # extraObjects -- Deploy additional Kubernetes manifests.
 # This field is expected to be either a multi-line string, a list of strings, or a list of objects.
 #
-extraObjects: []
+extraObjects: []