Attaching additional certificates

[senpro-ingwersenk]

Hello there,

I just ran into the issue where mounting a ConfigMap with our company's DPI SSL certificate results in:

Trusting custom certificates from /opt/custom-certificates.
ERROR: Access denied '/opt/custom-certificates'

That checks out, as the container itself runs with UID/GID 1000 and c_rehash needs root to change the apropriate files.

Could you please add an option to properly add the certificates?

This is in .Values.main.config:

      extraVolumes:
        - name: sophos-ssl-dpi-vol
          configMap:
            name: sophos-ssl-dpi-ca
      extraVolumeMounts:
        - name: sophos-ssl-dpi-vol
          mountPath: /opt/custom-certificates
          readOnly: true

Nothing too fancy, but mounts the cert. :)
(Yes, it should be a secret, but trust me, Sophos is enough of a PITA to worry about this, too... xD)

Thanks!

[Vad1mo]

I don't understand the question or how this chart can support your use case..

extraVolumes and extraVolumeMounts are already supported.

did you try to set securityContext fsGroup: 1000

[senpro-ingwersenk]

Correct; but regenerating the SSL bundle with c_rehash requires root permissions, which the container, due to the default securityContext, does not have, as it launches as non-root with UID/GID 1000 (the user named node). So the docker-entrypoint.s can not actually run that without issues.

As a workaround, you could probably just use an Initcontainer with the same image/tag, mount /etc/ssl into an emptyDir and then run the c_rehash during the init as root - and then let the main container just run normally.