API Connect

OpenShift - APIC 10.0.5.x

We are looking to upload/mount a SSL certificate that we use in a custom module for TLS verification.  We'd prefer not to add the certificate into the module as it will expire once a year.  I'm assuming the best approach would be to create a custom secret and add it to a VolumeMount.  Is something like that possible or do we need a different approach?  We are using a top level CR if that matters.

Matt

Unfortunately the CRs do not have a way for you to supply any extra secrets to mount as volumes. You could supply the SSL certificate in an environment variable instead, which would need to be in the admin container.

If you want to use the cert in a web browser flow then you would need to grab the env var and save it into your site's Drupal database in a Drupal cron job. This is because pjp-fpm wil not allow arbitrary environment variables through into the PHP code. If you only use the cert in a Drupal cron job then you do not need to save it into the database as you will always be able to access it.

If the SSL certificate is actually a private key and public cert then it would probably be a good idea to use an encyrpted key and have the password in the module. Example yaml in the top CR:

spec:
...
  template:
  - containers:
    - env:
      - name: MY_CUSTOM_SSL_CERT
        value: <base64-encoded-x590-cert>
      name: admin
    name: ptl-www

There is not a mechanism to mount custom secrets into the top CR or the ptl CR unfortunately, but you can add custom environment variables to the portal containers. You would need to add the env var to the admin container of the www pods and then add a cron job to your module to grab the env var and save it into the database. This is necessary as the env var will not be visible inside php-fpm when your code runs as part of the browser request, but the cron jobs run outside of php-fpm so they can access the env var.

If the cert has a private key part then you probably want to encrypt that and then decrypt in your module code. Example top CR yaml:

spec:
...
  template:
  - containers:
    - env:
      - name: MY_CUSTOM_SSL_CERT
        value: <x590-cert-encoded-with: base64 -w0>
      name: admin
    name: ptl-www