<p>I have managed MariaDB with SSL enabled deployed in Azure, and i created a service type &quot;external&quot; named &quot;mysql&quot; within my k8s cluster.</p>
<p>Then i created a secret like follwing :</p>
<pre><code>kubectl create secret generic ca-cert --from-file=ca-cert=./BaltimoreCyberTrustRoot.crt.pem -n app
</code></pre>
<p>PS: where i got <code>BaltimoreCyberTrustRoot.crt.pem</code> from :</p>
<p><code>wget https://www.digicert.com/CACerts/BaltimoreCyberTrustRoot.crt.pem</code></p>
<p>Then i deployed Wordpress:</p>
<pre><code>helm template wp azure-marketplace/wordpress -n app --create-namespace -f values.yml
</code></pre>
<p>where values.yml looks like :</p>
<pre><code>##############################PART1########################
#pvc wordpress
persistence:
  enabled: false

#pvc mariadb
mariadb:
  enabled: false 

externalDatabase:
  host: mysql
  port: 3306
  user: benighil@benighil 
  password: &quot;SomePassword&quot;
  database: bitnami_wordpress

##############################PART2########################
extraEnvVars:
  - name: &quot;WORDPRESS_DATABASE_SSL_CA_FILE&quot;
    value: /tmp/ca-cert

## Additional volume mounts
## Example: Mount CA file
extraVolumeMounts:
  - name: ca-cert
    mountPath: /tmp

## Additional volumes
## Example: Add secret volume
extraVolumes:
 - name: ca-cert
   secret:
     secretName: ca-cert
</code></pre>
<p>But the pods logs gives :</p>
<pre><code>wordpress 22:08:07.00 ERROR ==&gt; Could not connect to the database
</code></pre>
<p><strong>NOTE1:</strong> When i exec into pod, and do : <code>env | grep WORDPRESS_DATABASE_SSL_CA_FILE</code> it gives : <code>WORDPRESS_DATABASE_SSL_CA_FILE=/tmp/ca-cert</code> and when i do <code>cat /tmp/ca-cert</code> it gives its content normally.</p>
<p><strong>NOTE2:</strong> The credentials are CORRECT, because when i desable SSL from MariaDB, and delete the whole PART2 from <code>values.yml</code> then it works fine!</p>
<p>Any help please?</p>

<p>So make sure that the DB exist on the Azure MariaDB server and the second thing is that path is further used by the daemon <code>tmp</code> so certs should not be mounted here, somewhere where the daemon can read.</p>
<pre><code>wordpress 04:19:09.91 INFO  ==&gt; Persisting WordPress installation
/opt/bitnami/scripts/libpersistence.sh: line 51: /tmp/perms.acl: Read-only file system
</code></pre>
<p>so make the below changes and it should work</p>
<pre><code>extraEnvVars:
  - name: &quot;WORDPRESS_DATABASE_SSL_CA_FILE&quot;
    value: /opt/bitnami/wordpress/tmp/ca-cert
  - name: WORDPRESS_ENABLE_DATABASE_SSL
    value: &quot;yes&quot;

## Additional volume mounts
## Example: Mount CA file
extraVolumeMounts:
  - name: ca-cert
    mountPath: /opt/bitnami/wordpress/tmp

</code></pre>
<p>or you will have to set extra params for the same path</p>
<pre><code>  containerSecurityContext:
    enabled: true
    privileged: false
    allowPrivilegeEscalation: false
    ## Requires mounting an `extraVolume` of type `emptyDir` into /tmp
    ##
    readOnlyRootFilesystem: false
    capabilities:
      drop:
        - ALL
</code></pre>
