feat(chart): add extraVolumes and extraVolumeMounts

.github/workflows/e2e.yaml

@@ -32,6 +32,10 @@ jobs:
 
       - name: Setup helm
         uses: azure/setup-helm@v5
+        with:
+          version: latest
+          # fail instead of silently falling back to Helm v3, which lacks --wait=watcher
+          latest-fallback: "false"
 
       - name: Setup kind
         uses: helm/kind-action@v1

README.md

@@ -122,6 +122,31 @@ When `validate_key` is enabled, the operator verifies at startup that the config
 
 Supported providers: `aws` (KMS), `azure` (Key Vault), `gcp` (Cloud KMS), `vault` (Transit Engine), `file` (embedded)
 
+**Behind a TLS-inspecting proxy:**
+
+To trust additional CAs (e.g. a firewall's inspection CA) *on top of* the system roots, mount them as PEM files and add the directory to `SSL_CERT_DIR` (don't use `SSL_CERT_FILE`, which replaces the system bundle). Proxy settings (`HTTPS_PROXY`/`NO_PROXY`) are honoured too.
+
+`SSL_CERT_DIR` replaces Go's default CA *directory* list (`/etc/ssl/certs`, `/etc/pki/tls/certs`) but not its bundle-file lookup, so list the defaults explicitly: this keeps system trust intact whichever layout the image uses, including custom builds.
+
+```yaml
+# Helm values
+manager:
+  env:
+    - name: SSL_CERT_DIR
+      value: /etc/ssl/certs:/etc/pki/tls/certs:/etc/ssl/extra-ca
+  extraVolumes:
+    - name: extra-ca
+      configMap:
+        name: corp-ca # ConfigMap whose keys are PEM-encoded CA certificates
+        optional: true # if absent, the directory is empty and only the system CAs are trusted
+  extraVolumeMounts:
+    - name: extra-ca
+      mountPath: /etc/ssl/extra-ca
+      readOnly: true
+```
+
+CAs are loaded once at startup; restart the pod after creating or rotating the ConfigMap.
+
 ### Token Resources
 
 Create `Token` (namespaced) or `ClusterToken` (cluster-scoped) resources to generate secure `Secret` objects:

deploy/charts/github-token-manager/Chart.yaml

@@ -4,4 +4,4 @@ name: github-token-manager
 description: A Helm chart for github-token-manager
 
 type: application
-version: 0.4.0
+version: 0.5.0

deploy/charts/github-token-manager/templates/deployment.yaml

@@ -93,6 +93,9 @@ spec:
             - mountPath: /config
               name: config
               readOnly: true
+            {{- with $manager.extraVolumeMounts }}
+            {{- toYaml . | nindent 12 }}
+            {{- end }}
       {{- with $manager.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}
@@ -113,3 +116,6 @@ spec:
             defaultMode: 444
             optional: true
             secretName: {{ .Values.config.secretName }}
+        {{- with $manager.extraVolumes }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}

deploy/charts/github-token-manager/values.yaml

@@ -65,6 +65,8 @@ metrics:
 ##   tolerations: list of tolerations (optional)
 ##   nodeSelector: node selector (optional)
 ##   env: list of additional environment variables to set on the manager container
+##   extraVolumes: list of additional pod volumes (optional)
+##   extraVolumeMounts: list of additional manager container volume mounts (optional)
 ##   resources: manager container resource requests and limits
 ## manager
 ##   repository: image repository
@@ -81,6 +83,10 @@ manager:
   # additional environment variables to set on the controller container
   # e.g. `[{name: VAULT_ADDR, value: http://vault:8200}]`
   env: []
+  # additional volumes and mounts for the manager pod/container, e.g. to extend
+  # the trusted CAs: set env SSL_CERT_DIR to the mountPath of a ConfigMap of PEMs
+  extraVolumes: []
+  extraVolumeMounts: []
   extraArgs: {}
   resources:
     limits: