Introduction
This guide outlines how to securely add a certificate (or any other secret) to a specific path within your Artifactory Helm chart deployment using Kubernetes Secrets. This method ensures your sensitive files are managed securely and made available to your Artifactory pods where needed.
Prerequisite: Create the Kubernetes Secret
Regardless of the method you choose below, you first need to create a Kubernetes secret from your certificate file. This command creates a generic secret named my-crt-secret in the artifactory namespace, containing the blabla.com.crt file.
kubectl create secret generic my-crt-secret -n artifactory --from-file=blabla.com.crt
Resolution
Choose one of the following methods to integrate your certificate:
Method 1: Using global.customCertificates (Recommended)
This is the recommended approach for adding trusted CA certificates, as Artifactory will automatically place them in the correct trusted key store directory.
Step 1: Configure Your values.yaml File
Modify your values.yaml by enabling customCertificates and specifying the secret name:
global:
## certificates added to this secret will be copied to $JFROG_HOME/artifactory/var/etc/security/keys/trusted directory
customCertificates:
enabled: true
certificateSecretName: my-crt-secret
Method 2: Using customVolumes and customVolumeMounts
This method offers more granular control over where the certificate file is mounted within the Artifactory pod. It can be useful for specific use cases where certificates are needed in non-standard locations.
Step 1: Configure Your values.yaml File
Add or modify the customVolumes and customVolumeMounts sections under the artifactory configuration in your values.yaml:
artifactory:
# ... other artifactory configurations ...
customVolumes: |
- name: my-crt-volume # Descriptive name for the volume
secret:
secretName: my-crt-secret # Must match the name of the secret created in Step 1
customVolumeMounts: |
- name: my-crt-volume # Must match the 'name' in customVolumes
mountPath: "/opt/jfrog/artifactory/var/etc/security/keys/trusted/blabla.com.crt" # Desired path inside the pod
subPath: "blabla.com.crt" # The key in the secret to mount (filename)
readOnly: true # Recommended for certificates
# ... other configurations …
Warning:
If you place the certificate in a path outside of /opt/jfrog/artifactory/var (The PVC path), the certificate will become read-only. Consequently, it cannot be moved once it is inside for example.
Applying the Changes:
After creating the secret and updating your values.yaml file with your chosen method, apply the changes to your Helm release
Conclusion
By following these steps, you can successfully add certificates to your Artifactory Helm deployment using Kubernetes Secrets. The global.customCertificates method is generally recommended for ease of use and integration with Artifactory's trusted certificate store. However, the customVolumes method provides flexibility for specific path requirements. Both approaches ensure your certificates are managed securely. Always ensure your chosen mount paths and configurations align with Artifactory's requirements for the intended use of the certificate.