Add aviability extra volumes and extra mount points on core and portal pods (or all pods)

[nevlkv]

add to deployments templates and you can use variables

ex:

extraVolumes:
  []
  # - name: example
  #   configMap:
  #     name: example

# -- Extra Volume Mounts for the container
extraVolumeMounts:
  []
  # - name: example
  #   mountPath: /example

and variable caBundleSecretName becomes depricatad legacy

[nevlkv]

#2358

[MinerYang]

Hi @nevlkv <

Could you please help to describe more about your using scenario of extraVolume for core and other pods.
And let's keep tracking the registry pod specific case on issue #2357

Best,
Miner

[nevlkv]

i want to mount configmaps with ca created by trusted manager and i need to patch existed helm chart, i can not use caBundleSecretName becose source is secret

ex:

  strategicMergePatches:
  - apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: harbor-core
      namespace: harbor
    spec:
      template:
        spec:
          containers:
          - name: core
            volumeMounts:
            - mountPath: /etc/ssl/certs/my-ca.crt
              name: my-ca-bundle
              subPath: my-ca.crt
          volumes:
          - configMap:
              defaultMode: 420
              name: my-ca-bundle
            name: my-ca-bundle

[MinerYang]

i want to mount configmaps with ca created by trusted manager and i need to patch existed helm chart, i can not use caBundleSecretName becose source is secret

We would not recommend to using extraVolume for ca inject instead of using caBundleSecretName.

• This mount path /etc/ssl/certs/my-ca.crt would not properly work for Photon based OS
• Since we've already serve a inject process for ca bundle while pod create, extra opt other than the native injetct process would possibly require rehash efforts in case interfere each other.

So I would suggest you might either

• Keep using extraVolume at your deploy side by leverage the helm hook mechanism.
• Or extract the ca from the source secret and properly handled by configure caBundleSecretName.

Best,
Miner

[nevlkv]

This mount path /etc/ssl/certs/my-ca.crt would not properly work for Photon based OS

why not works ?

works 3 months with same state

[nevlkv]

properly handled by configure caBundleSecretName.

in template

is same as my definition, but hardcoded