Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IDP-1518 Mount certificate store from Azure File Share rather than Azure Key Vault #63

Merged
merged 1 commit into from
May 27, 2024

Conversation

starcraft66
Copy link
Member

Description of changes

Now that we have build a complete certificate store for Workleap containers, cannot fit in a Key vault for 2 reasons:

  • Key vaults cap at 25/50KiB depending on the SKU and our certificate store is larger than that
  • Key vaults can only store a single certificate and our store contains hundreds

The complete certificate store can now be mounted from the Azure File share it is located in.

Breaking changes

Reworked the helm values for the certificate store as the Azure Files CSI driver requires more information than the Key Vault CSI driver.

Additional checks

Tested using server-side dry-run on a dev cluster:

PS C:\Users\tristan.g-hane\src\gsoft-helm-charts> helm template --set certificateStore.enabled=true test ./charts/aspnetcore --debug | kubectl apply --dry-run=server -f -
install.go:218: [debug] Original chart version: ""
install.go:235: [debug] CHART PATH: C:\Users\tristan.g-hane\src\gsoft-helm-charts\charts\aspnetcore

poddisruptionbudget.policy/test-pdb created (server dry run)
service/test-service created (server dry run)
deployment.apps/test-deployment created (server dry run)
ingress.networking.k8s.io/test-ingress created (server dry run)
PS C:\Users\tristan.g-hane\src\gsoft-helm-charts> helm template --set certificateStore.enabled=false test ./charts/aspnetcore --debug | kubectl apply --dry-run=server -f -
install.go:218: [debug] Original chart version: ""
install.go:235: [debug] CHART PATH: C:\Users\tristan.g-hane\src\gsoft-helm-charts\charts\aspnetcore

poddisruptionbudget.policy/test-pdb created (server dry run)
service/test-service created (server dry run)
deployment.apps/test-deployment created (server dry run)
ingress.networking.k8s.io/test-ingress created (server dry run)
  • Updated the documentation of the project to reflect the changes
  • Added new tests that cover the code changes

@starcraft66 starcraft66 requested a review from a team as a code owner May 24, 2024 20:28
@starcraft66 starcraft66 merged commit 45ecf79 into main May 27, 2024
7 checks passed
@starcraft66 starcraft66 deleted the feature/tgh/idp-1518 branch May 27, 2024 13:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants