feat: mount RDS certificates in devlake (#489)

Signed-off-by: flacatus <flacatus@redhat.com>

Author: flacatus

components/konflux-devlake/internal-staging/helm-values.yaml

@@ -50,26 +50,7 @@ lake:
     GITHUB_GRAPHQL_JOB_COLLECTION_MODE: "PAGINATING"
     GITHUB_GRAPHQL_JOB_PAGINATING_PAGE_SIZE: "100"
 
-    DB_URL: "mysql://$(MYSQL_USER):$(MYSQL_PASSWORD)@$(MYSQL_SERVER):$(MYSQL_PORT)/$(MYSQL_DATABASE)?charset=$(DB_CHARSET)&parseTime=$(DB_PARSE_TIME)&loc=$(DB_LOCATION)&tls=true"
-    # Go's crypto/x509 on Debian reads /etc/ssl/certs/ by default, not
-    # /etc/pki/ where OpenShift mounts the trusted CA ConfigMap.
-    SSL_CERT_FILE: "/etc/ssl/combined/ca-bundle.crt"
-  initContainers:
-    - name: build-ca-bundle
-      image: quay.io/konflux-ci/konflux-devprod/devlake-backend
-      command:
-        - sh
-        - -c
-        - cat /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem /etc/ssl/rds/rds-ca-bundle.pem > /etc/ssl/combined/ca-bundle.crt
-      volumeMounts:
-        - name: trusted-ca
-          mountPath: /etc/pki/ca-trust/extracted/pem
-          readOnly: true
-        - name: rds-ca
-          mountPath: /etc/ssl/rds
-          readOnly: true
-        - name: combined-ca
-          mountPath: /etc/ssl/combined
+    DB_URL: "mysql://$(MYSQL_USER):$(MYSQL_PASSWORD)@$(MYSQL_SERVER):$(MYSQL_PORT)/$(MYSQL_DATABASE)?charset=$(DB_CHARSET)&parseTime=$(DB_PARSE_TIME)&loc=$(DB_LOCATION)&tls=custom&ca-cert=/etc/ssl/rds/rds-ca-bundle.pem"
   volumes:
     - name: trusted-ca
       configMap:
@@ -83,18 +64,13 @@ lake:
         items:
           - key: AWS_RDS_CRTS
             path: rds-ca-bundle.pem
-    - name: combined-ca
-      emptyDir: {}
   volumeMounts:
     - name: trusted-ca
       mountPath: /etc/pki/ca-trust/extracted/pem
       readOnly: true
     - name: rds-ca
       mountPath: /etc/ssl/rds
       readOnly: true
-    - name: combined-ca
-      mountPath: /etc/ssl/combined
-      readOnly: true
   extraEnvsFromSecret: konflux-devlake-secrets
 
 mysql: