chore: Add s3 custom CA airgapped support

charts/plane-enterprise/Chart.yaml

@@ -6,7 +6,7 @@ description: Meet Plane. An Enterprise software development tool to manage issue
 type: application
 
 version: 1.4.0
-appVersion: "1.14.0"
+appVersion: "v1.14.0-rc6"
 
 home: https://plane.so/
 icon: https://plane.so/favicon/favicon-32x32.png

charts/plane-enterprise/README.md

@@ -93,6 +93,8 @@
 |---|:---:|:---:|---|
 | planeVersion | v1.14.0 | Yes |  Specifies the version of Plane to be deployed. Copy this from prime.plane.so. |
 | airgapped.enabled | false | No |  Specifies the airgapped mode the Plane API runs in. |
+| airgapped.s3CrtFileLocation | "/s3-custom-ca/s3-custom-ca.crt" | No | Path inside the container to the CA certificate file used for S3 (Boto). Effective when `airgapped.enabled=true` and `airgapped.s3SecretName` is set. |
+| airgapped.s3SecretName | "" | No | Name of the Secret that contains the CA certificate (.crt). The Secret must include a data key whose filename matches the basename of `airgapped.s3CrtFileLocation` (default: `s3-custom-ca.crt`). Used to override S3’s CA when `airgapped.enabled=true`. | 
 | license.licenseDomain | plane.example.com | Yes | The fully-qualified domain name (FQDN) in the format `sudomain.domain.tld` or `domain.tld` that the license is bound to. It is also attached to your `ingress` host to access Plane. |
 
 ### Postgres

charts/plane-enterprise/templates/config-secrets/app-env.yaml

@@ -49,8 +49,13 @@ data:
 
   API_KEY_RATE_LIMIT: {{ .Values.env.api_key_rate_limit | default "60/minute" | quote }}
   MINIO_ENDPOINT_SSL: {{ .Values.services.minio.env.minio_endpoint_ssl | default false | ternary "1" "0" | quote }}
+  USE_STORAGE_PROXY: {{ .Values.services.minio.use_storage_proxy | default false | ternary "1" "0" | quote }}
   INTAKE_EMAIL_DOMAIN: {{ .Values.env.email_service_envs.smtp_domain | default "" | quote }}
 
+  {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }}
+  AWS_CA_BUNDLE: {{ .Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt" | quote }}
+  {{- end }}
+
   SENTRY_DSN: {{ .Values.env.sentry_dsn | default "" | quote}}
   SENTRY_ENVIRONMENT: {{ .Values.env.sentry_environment | default "" | quote}}
   DEBUG: "0"

charts/plane-enterprise/templates/workloads/api.deployment.yaml

@@ -39,6 +39,64 @@ spec:
       annotations:
         timestamp: {{ now | quote }}
     spec:
+      volumes:
+      {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }}
+        - name: s3-custom-ca
+          secret:
+            secretName: {{ .Values.airgapped.s3SecretName }}
+            items:
+              - key: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }}
+                path: {{ (.Values.airgapped.s3CrtFileLocation | default "/s3-custom-ca/s3-custom-ca.crt") | base }}
+      {{- end }}
+        - name: ca-certificates
+          emptyDir: {}
+      initContainers:
+      - name: install-ca-certs
+        image: ubuntu:22.04
+        command:
+          - /bin/bash
+          - -c
+          - |
+            set -e
+            echo "Installing custom CA certificates..."
+
+            # Install ca-certificates package and create directories
+            apt-get update && apt-get install -y ca-certificates
+            mkdir -p /shared-certs
+
+            # Copy existing system CA certificates to shared directory
+            if [ -d /etc/ssl/certs ]; then
+              cp -r /etc/ssl/certs/* /shared-certs/ 2>/dev/null || true
+            fi
+
+            # Ensure ca-certificates directory exists
+            mkdir -p /usr/local/share/ca-certificates
+
+            # Install custom S3 CA if available
+            {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }}
+            S3_CERT_FILE="{{ (.Values.airgapped.s3CrtFileLocation | default "s3-custom-ca.crt") | base }}"
+            if [ -f "/s3-custom-ca/$S3_CERT_FILE" ]; then
+              echo "Installing S3 custom CA certificate..."
+              cp "/s3-custom-ca/$S3_CERT_FILE" /usr/local/share/ca-certificates/s3-custom-ca.crt
+              cp "/s3-custom-ca/$S3_CERT_FILE" /shared-certs/s3-custom-ca.crt
+            fi
+            {{- end }}
+
+            # Update CA certificates
+            update-ca-certificates
+
+            # Copy updated system certificates to shared volume
+            cp -r /etc/ssl/certs/* /shared-certs/ 2>/dev/null || true
+
+            echo "CA certificates installed successfully"
+        volumeMounts:
+        {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }}
+          - name: s3-custom-ca
+            mountPath: /s3-custom-ca
+            readOnly: true
+        {{- end }}
+          - name: ca-certificates
+            mountPath: /shared-certs
       containers:
       - name: {{ .Release.Name }}-api
         imagePullPolicy: {{ .Values.services.api.pullPolicy | default "Always" }}
@@ -52,6 +110,21 @@ spec:
           limits:
             memory: {{ .Values.services.api.memoryLimit  | default "1000Mi" | quote }}
             cpu: {{ .Values.services.api.cpuLimit | default "500m" | quote}}
+        volumeMounts:
+          - name: ca-certificates
+            mountPath: /etc/ssl/certs
+            readOnly: true
+        {{- if and .Values.airgapped.enabled .Values.airgapped.s3SecretName }}
+        env:
+          - name: SSL_CERT_FILE
+            value: "/etc/ssl/certs/ca-certificates.crt"
+          - name: SSL_CERT_DIR
+            value: "/etc/ssl/certs"
+          - name: REQUESTS_CA_BUNDLE
+            value: "/etc/ssl/certs/ca-certificates.crt"
+          - name: CURL_CA_BUNDLE
+            value: "/etc/ssl/certs/ca-certificates.crt"
+        {{- end }}
         command:
           - ./bin/docker-entrypoint-api-ee.sh
         envFrom:

charts/plane-enterprise/values.yaml

@@ -12,6 +12,14 @@ license:
 
 airgapped:
   enabled: false
+  # The boto module used by API does not use the CA bundles in the container, so we need to
+  # mount the CA bundle into the API pod by passing it in as an environment
+  # variable. Should be the full path to the CA bundle file, e.g.
+  # "/s3-custom-ca/s3-custom-ca.crt"
+  s3CrtFileLocation: "/s3-custom-ca/s3-custom-ca.crt"
+  # The Secret must contain a data key whose name matches the filename in s3CrtFileLocation
+  # (default: "s3-custom-ca.crt").
+  s3SecretName: ""
 
 ingress:
   enabled: true
@@ -68,6 +76,7 @@ services:
     root_user: admin
     root_password: password
     assign_cluster_ip: false
+    use_storage_proxy: false
     env:
       minio_endpoint_ssl: false