Trust custom CA bundle for outgoing caching connections (#9427)

* Fix namespace for squid component

Signed-off-by: Alex Misstear <[email protected]>

* Trust custom CA bundle for outgoing caching connections

Signed-off-by: Alex Misstear <[email protected]>

---------

Signed-off-by: Alex Misstear <[email protected]>

Author: amisstea

argo-cd-apps/base/member/infra-deployments/squid/squid.yaml

@@ -30,7 +30,7 @@ spec:
         repoURL: https://github.com/redhat-appstudio/infra-deployments.git
         targetRevision: main
       destination:
-        namespace: proxy
+        namespace: caching
         server: '{{server}}'
       syncPolicy:
         automated:

components/squid/base/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 
 resources:
 - rbac.yaml
+- trusted-ca-configmap.yaml

components/squid/base/trusted-ca-configmap.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trusted-ca
+  labels:
+    config.openshift.io/inject-trusted-cabundle: "true"

components/squid/development/squid-helm-generator.yaml

@@ -44,3 +44,16 @@ valuesInline:
       - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64}
     size: 192
     maxObjectSize: 128
+  tlsOutgoingOptions:
+    caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
+  volumes:
+    - name: trusted-ca
+      configMap:
+        name: trusted-ca
+        items:
+          - key: ca-bundle.crt
+            path: tls-ca-bundle.pem
+  volumeMounts:
+    - name: trusted-ca
+      mountPath: /etc/pki/ca-trust/extracted/pem
+      readOnly: true

components/squid/staging/squid-helm-generator.yaml

@@ -44,3 +44,16 @@ valuesInline:
       - ^https://quayio-production-s3\.s3[a-z0-9.-]*\.amazonaws\.com/sha256/.+/[a-f0-9]{64}
     size: 1536
     maxObjectSize: 256
+  tlsOutgoingOptions:
+    caFile: /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
+  volumes:
+    - name: trusted-ca
+      configMap:
+        name: trusted-ca
+        items:
+          - key: ca-bundle.crt
+            path: tls-ca-bundle.pem
+  volumeMounts:
+    - name: trusted-ca
+      mountPath: /etc/pki/ca-trust/extracted/pem
+      readOnly: true