apps/base/encapi/configmap.yaml

@@ -11,3 +11,5 @@ data:
   DBPORT: "5432"
   DBUSER: encapi
   DBSSL: require
+  ENCAPI_OIDC_ISSUER: https://vault.service.consul:8200/v1/identity/oidc
+  SSL_CERT_FILE: /etc/ssl/combined/ca-certificates.crt

apps/base/encapi/deployment.yaml

@@ -6,6 +6,7 @@ metadata:
   namespace: encapi
   annotations:
     configmap.reloader.stakater.com/auto: "true"
+    secret.reloader.stakater.com/reload: "vault-ca-cert"
 spec:
   replicas: 2
   selector:
@@ -21,9 +22,22 @@ spec:
         app: encapi
     spec:
       automountServiceAccountToken: true
+      initContainers:
+        - name: combine-certs
+          image: alpine:3
+          command:
+            - sh
+            - -c
+            - cat /etc/ssl/certs/ca-certificates.crt /custom-ca/ca.crt > /combined-certs/ca-certificates.crt
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /custom-ca
+              readOnly: true
+            - name: combined-certs
+              mountPath: /combined-certs
       containers:
         - name: encapi
-          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.1.2
+          image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/encapi:v0.2.0
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8000
@@ -38,6 +52,10 @@ spec:
             - secretRef:
                 name: environment
                 optional: false
+          volumeMounts:
+            - name: combined-certs
+              mountPath: /etc/ssl/combined
+              readOnly: true
           livenessProbe:
             httpGet:
               path: /healthz
@@ -61,4 +79,13 @@ spec:
             limits:
               cpu: 500m
               memory: 256Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+        - name: combined-certs
+          emptyDir: {}
       restartPolicy: Always