Use Case and Context

For use with Cluster trust bundles. The way a CA bundle is added to the container's CA trust store depends on the distro:

Debian distros:

• Place the certificates in /usr/local/share/ca-certificates with .crt extension.
• Run update-ca-certificates as root.
• The output is at /etc/ssl/certs/ which is where we want to mount our volume to be populated.

Redhat distros:

• Place the certificates in /usr/share/pki/ca-trust-source/anchors with .pem extension.
• Run update-ca-trust as root.
• The output is at /etc/pki/ca-trust/extracted which is where we want to mount our volume to be populated.

I plan to mount a volume at the appropriate location for my containers and would like it to be populated with the contents of the CA trust store in the expected layout based on distro.

Limitiations of the current implementation

• Only the PV can be mounted. Cluster trust bundles cannot be mounted.
• The volume mount path is passed to the controller. Therefore, one controller is required for each volume mount path.
• The command that must be run cannot be provided directly via the command field - update-ca-trust vs update-ca-certificates

How I would like to implement this.

Currently we have a callback to get the pod container arguments. Rather we should have a callback for the entire pods spec. The CRD is already being provided as a callback argument.

Then we can use the CRD to provide these variables. One CRD for each type of distro - RedhatCaTrustStore, DebianCaTrustStore.

apiVersion: hello.example.com/v1alpha1
kind: Hello
metadata:
  name: RedhatCaTrustStore
spec:
  bundleMountPath: /usr/share/pki/ca-trust-source/
  volumeMountPath: /etc/pki/ca-trust/extracted
  command: update-ca-trust

My container's PVC can reference what type of distro it'd like to use.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: MyContainersCaTrustStore
spec:
  accessModes:
  - ReadWriteOnce
  dataSourceRef:
    apiGroup: hello.example.com
    kind: Hello
    name: RedhatCaTrustStore # or DebianCaTrustStore

A single controller will be able to handle both these scenarios as well.