{"action":"created","issue":{"url":"https://api.github.com/repos/mintel/dex-k8s-authenticator/issues/42","repository_url":"https://api.github.com/repos/mintel/dex-k8s-authenticator","labels_url":"https://api.github.com/repos/mintel/dex-k8s-authenticator/issues/42/labels{/name}","comments_url":"https://api.github.com/repos/mintel/dex-k8s-authenticator/issues/42/comments","events_url":"https://api.github.com/repos/mintel/dex-k8s-authenticator/issues/42/events","html_url":"https://github.com/mintel/dex-k8s-authenticator/issues/42","id":333844519,"node_id":"MDU6SXNzdWUzMzM4NDQ1MTk=","number":42,"title":"Specifying caCerts in Helm chart values results in unused CA certificates","user":{"login":"trinitronx","id":122524,"node_id":"MDQ6VXNlcjEyMjUyNA==","avatar_url":"https://avatars2.githubusercontent.com/u/122524?v=4","gravatar_id":"","url":"https://api.github.com/users/trinitronx","html_url":"https://github.com/trinitronx","followers_url":"https://api.github.com/users/trinitronx/followers","following_url":"https://api.github.com/users/trinitronx/following{/other_user}","gists_url":"https://api.github.com/users/trinitronx/gists{/gist_id}","starred_url":"https://api.github.com/users/trinitronx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trinitronx/subscriptions","organizations_url":"https://api.github.com/users/trinitronx/orgs","repos_url":"https://api.github.com/users/trinitronx/repos","events_url":"https://api.github.com/users/trinitronx/events{/privacy}","received_events_url":"https://api.github.com/users/trinitronx/received_events","type":"User","site_admin":false},"labels":[{"id":833509887,"node_id":"MDU6TGFiZWw4MzM1MDk4ODc=","url":"https://api.github.com/repos/mintel/dex-k8s-authenticator/labels/bug","name":"bug","color":"d73a4a","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-06-19T21:24:21Z","updated_at":"2018-07-27T13:15:28Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Just tested this with the following:\r\n\r\n```\r\ncaCerts:\r\n  enabled: true\r\n  secrets:\r\n    # Array of Self Signed Certificates\r\n    # cat CA.crt | base64 -w 0\r\n    #\r\n    #     name: The internal k8s name of the secret we create. It's also used in\r\n    #     the volumeMount name. It must respect the k8s naming convension (avoid\r\n    #     upper-case and '.' to be safe).\r\n    #\r\n    #     filename: The filename of the CA to be mounted. It must end in .crt for\r\n    #     update-ca-certificates to work\r\n    #\r\n    #     value: The base64 encoded value of the CA\r\n    #\r\n    - name: ca-cert1\r\n      filename: ca1.crt\r\n      value: \"XXXX.....base64 cert 1 here...\"\r\n    - name: ca-cert2\r\n      filename: ca2.crt\r\n      value: \"XXXX.....base64 cert 2 here...\"\r\n```\r\n\r\nIt looks like the `Deployment` does end up with these listed as mounts:\r\n\r\n```\r\n    Mounts:\r\n      /app/config.yaml from config (rw)\r\n      /certs/ca1.crt from login-dex-k8s-authenticator-ca-cert1 (rw)\r\n      /certs/ca2.crt from login-dex-k8s-authenticator-ca-cert2 (rw)\r\n```\r\n\r\nHowever, I still get validation errors.  You can see that these files are actually mounted as directories inside the Pod:\r\n\r\n```\r\n# ls -lAR /certs/*\r\n/certs/ca1.crt:\r\ntotal 0\r\n\r\n/certs/ca2.crt:\r\ntotal 0\r\n```\r\n\r\nIf we inspect the file location on the Kubernetes host machine, we can see that it treats only the `name` as the true filename, while `ca1.crt` and `ca2.crt` are directories:\r\n\r\n```\r\ncore@ip-123-45-6-78 ~ $ sudo ls -lA /var/lib/kubelet/pods/9a98a5d0-7405-11e8-a008-0eb17fad7d94/volumes/kubernetes.io~secret/login-dex-k8s-authenticator-ca-cert1/\r\ntotal 0\r\ndrwxr-xr-x. 2 root root 60 Jun 19 21:13 ..2018_06_19_21_13_25.540309803\r\nlrwxrwxrwx. 1 root root 31 Jun 19 21:13 ..data -> ..2018_06_19_21_13_25.540309803\r\nlrwxrwxrwx. 1 root root 15 Jun 19 21:13 ca-cert1 -> ..data/ca-cert1\r\ndrwxrwxrwt. 2 root root 40 Jun 19 21:13 ca1.crt\r\n\r\ncore@ip-123-45-6-78 ~ $ sudo ls -lA /var/lib/kubelet/pods/9a98a5d0-7405-11e8-a008-0eb17fad7d94/volumes/kubernetes.io~secret/login-dex-k8s-authenticator-ca-cert2/\r\ntotal 0\r\ndrwxr-xr-x. 2 root root 60 Jun 19 21:13 ..2018_06_19_21_13_25.626894990\r\nlrwxrwxrwx. 1 root root 31 Jun 19 21:13 ..data -> ..2018_06_19_21_13_25.626894990\r\nlrwxrwxrwx. 1 root root 15 Jun 19 21:13 ca-cert2 -> ..data/ca-cert2\r\ndrwxrwxrwt. 2 root root 40 Jun 19 21:13 ca2.crt\r\n```\r\n\r\nSo, only those names `ca-cert2` and `ca-cert1` are valid files as far as the mountable `Secret` data content on the host looks.\r\n\r\nLooks like issues assumed fixed in #35 & #36 are still problems?\r\n\r\nAs it turns out, the `subPath` attribute for a volume mount does not actually work on files (see: kubernetes/kubernetes#62156 ).  This may be a bug in kubernetes, yet it it's current functional state, trying to use `caCerts` in this Helm chart does not work.  This `subPath` as directory mount behavior matches my experience since `subPath` was introduced, but the docs don't make it clear that plain file mounts are not yet supported."},"comment":{"url":"https://api.github.com/repos/mintel/dex-k8s-authenticator/issues/comments/408415022","html_url":"https://github.com/mintel/dex-k8s-authenticator/issues/42#issuecomment-408415022","issue_url":"https://api.github.com/repos/mintel/dex-k8s-authenticator/issues/42","id":408415022,"node_id":"MDEyOklzc3VlQ29tbWVudDQwODQxNTAyMg==","user":{"login":"alcasim","id":21107567,"node_id":"MDQ6VXNlcjIxMTA3NTY3","avatar_url":"https://avatars2.githubusercontent.com/u/21107567?v=4","gravatar_id":"","url":"https://api.github.com/users/alcasim","html_url":"https://github.com/alcasim","followers_url":"https://api.github.com/users/alcasim/followers","following_url":"https://api.github.com/users/alcasim/following{/other_user}","gists_url":"https://api.github.com/users/alcasim/gists{/gist_id}","starred_url":"https://api.github.com/users/alcasim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alcasim/subscriptions","organizations_url":"https://api.github.com/users/alcasim/orgs","repos_url":"https://api.github.com/users/alcasim/repos","events_url":"https://api.github.com/users/alcasim/events{/privacy}","received_events_url":"https://api.github.com/users/alcasim/received_events","type":"User","site_admin":false},"created_at":"2018-07-27T13:15:28Z","updated_at":"2018-07-27T13:15:28Z","author_association":"NONE","body":"Hi @nabadger I tried modifying the deployment template as you suggested and worked fine for me too :)"}}
{"actor":{"display_login":"alcasim"}}