Allow user defined volumes/volumeMounts for diracx pod

[maxnoe]

For our integration tests and in prod, we need to mount a volume of CA certificates (the EGI trust store), but the diracx chart does not allow user-defined extra volumes.

Closes #259

cc @volodymyrss @natthan-pigoux

[chrisburr]

I think this needs an issue explaining why you need them.

[maxnoe]

As written above:

For our integration tests and in prod, we need to mount a volume of CA certificates (the EGI trust store)

#259

[maxnoe]

To be honest, I am a bit surprised that this wasn't possible. I thought this chart is used in prod by LHCb, how do you handle the CA certificates?

[chaen]

After internal discussion.

This is fine but a few points:

• the volume definition in the values.yaml shouldn't be in diracx subsection because this is targeted at the diracx python part so to say. It should rather go to global.
• You probably want to mount it similarly to all the other containers (the inits, the cli, etc)
• For your custom CA issue, you would have to mount the EGI truststore on top of the system ones.

To be honest, I am a bit surprised that this wasn't possible. I thought this chart is used in prod by LHCb, how do you handle the CA certificates?

We only faced publicly trusted certificate so far. We did not have to use self sign anywhere except in the run_demo.sh script.
It is not unreasonable in the future to envisage an extra_ca volume that the code could explicitly refer to, for example when submitting pilot or doing DMS.

[maxnoe]

Does diracx download CAs/CRLs via the BundleDelivery?

[chaen]

Does diracx download CAs/CRLs via the BundleDelivery?

No it does not

[maxnoe]

Ok, then I think we want to have this included. I'll address your comments.

[maxnoe]

For your custom CA issue, you would have to mount the EGI truststore on top of the system ones.

That's not needed. We inject our custom CA into the EGI trusted certs for development, the two volumes (one for /etc/grid-security/certificates, one for /etc/pki) already contain it.