<p>I have a Helm Chart. Which on deployment creates the following Kubernetes resources:</p>
<ol>
<li>A SSL enabled Service</li>
<li>A Container created with my Docker image which internally runs a Java process that communicates with the above service.</li>
<li>Kubernetes Secrets (SSL certificates and access keys), that are mounted inside the above container.</li>
</ol>
<p>The problem is my Container can not talk to my Service unless I add the SSL certificate to Java certificates. I do this by running the following command <strong>manually</strong> inside my docker with <strong>root</strong> user.</p>
<pre class="lang-sh prettyprint-override"><code>cd ${JAVA_HOME}/jre/lib/security 

keytool -keystore cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias myservicecert -file /home/myuser/.myservice/certs/public.crt
</code></pre>
<p>I want to automate the above steps but facing issues:</p>
<ul>
<li>I can not perform above steps inside the <code>Dockerfile</code> since the certificate is not available at that time. Obivious.</li>
<li>I can not add these steps in <code>entrypoint.sh</code> file of the docker because entrypoint file is executed by a different user than the root.</li>
<li>Another solution that I could think of is that change the permission of path <code>${JAVA_HOME}/jre/lib/security/cacerts</code> to <code>777</code> so that I can run these commands in <code>entrypoint.sh</code> without an issue. But I am not sure if this is the correct way to go due to security reasons. Suggestions on this ?</li>
<li>I do not want to set a custom location for certificates using <code>Djavax.net.ssl.trustStore</code> because then java will not have access to root certificates.</li>
</ul>
<p>What is correct way to achieve this?</p>

<h2>TL;DR</h2>
<p>You can add the certificate to the keystore in an <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer"><code>initContainer</code></a>. The keystore can be shared between the <code>initContainer</code> and the <code>container</code> using a <a href="https://kubernetes.io/docs/concepts/storage/volumes/" rel="nofollow noreferrer"><code>volume</code></a>.</p>
<hr />
<p>In this example we're mounting the <code>tls-secret</code> to the pod as a Kubernetes <a href="https://kubernetes.io/docs/concepts/configuration/secret/" rel="nofollow noreferrer">Secret</a>. The <code>tls-secret</code> contains the <code>tls.crt</code> which needs to be added to the keystore. We add the certificate to the keystore in the <code>initContainer</code> after copying the security files into a <code>volume</code> which is mounted to the pod's <code>container</code>.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: myapp
  labels:
    app: myapp
spec:
  containers:
  - name: myapp
    image: openjdk:8-jdk-slim-buster
    command:
    - bash
    - -c
    - |
      keytool -list -keystore /usr/local/openjdk-8/jre/lib/security/cacerts -alias local
      sleep infinity
    volumeMounts:
    - mountPath: /usr/local/openjdk-8/jre/lib/security
      name: cacerts
  initContainers:
  - name: init-cacerts
    image: openjdk:8-jdk-slim-buster
    command:
    - bash
    - -c
    - |
      cp -R /usr/local/openjdk-8/jre/lib/security/* /cacerts/
      keytool -import -noprompt -trustcacerts -alias local -file /security/tls.crt -keystore /cacerts/cacerts -storepass changeit
      keytool -list -keystore /cacerts/cacerts -alias local
    volumeMounts:
    - mountPath: /cacerts
      name: cacerts
    - mountPath: /security
      name: tls
  volumes:
  - name: cacerts
    emptyDir: {}
  - name: tls
    secret:
      secretName: tls-secret
      defaultMode: 0400
</code></pre>
<p><a href="https://i.stack.imgur.com/GAEYK.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GAEYK.png" alt="shared keystore" /></a></p>
