fix(k8s-infra): add ca.pem mount

[Michaelomeister]

Summary

Added missing ca.pem mount to both otel-agent and otel-deployment

Fixes

CA certificate support was added to values and exporter config, but ca.pem mounts were missing, rendering it unusable.
Related PR: #252
Related issue: #250

Summary by CodeRabbit

• New Features
  • Added optional support for a TLS CA certificate in OpenTelemetry components. When provided, the CA is now mounted alongside existing cert and key, enabling connections that require a custom CA.
• Chores
  • Bumped chart version from 0.14.1 to 0.14.2.

[coderabbitai]

Walkthrough

Adds conditional mounting of a CA certificate (ca.pem) to OpenTelemetry agent and deployment templates when .Values.otelTlsSecrets.ca is set, alongside existing cert.pem and key.pem handling. Also bumps the Helm chart version from 0.14.1 to 0.14.2.

Changes

Cohort / File(s)	Summary
Chart version bump charts/k8s-infra/Chart.yaml	Increment chart version 0.14.1 → 0.14.2.
OTel TLS CA inclusion charts/k8s-infra/templates/otel-agent/daemonset.yaml, charts/k8s-infra/templates/otel-deployment/deployment.yaml	Add conditional secret item mapping for ca.pem when .Values.otelTlsSecrets.ca is provided; retain existing cert.pem and key.pem items; adjust indentation/structure around secretName/items accordingly.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  participant U as User Values.yaml
  participant H as Helm
  participant T1 as otel-agent DaemonSet tpl
  participant T2 as otel Deployment tpl
  participant K as Kubernetes API

  U->>H: Provide .Values (otelTlsSecrets.enabled, .ca, .cert, .key)
  H->>T1: Render daemonset.yaml with values
  alt TLS secrets enabled
    alt CA provided (.Values.otelTlsSecrets.ca)
      T1-->>H: items include cert.pem, key.pem, ca.pem
    else No CA
      T1-->>H: items include cert.pem, key.pem
    end
  else TLS disabled
    T1-->>H: No TLS secret volume/items
  end

  H->>T2: Render deployment.yaml with values
  alt TLS secrets enabled
    alt CA provided
      T2-->>H: items include cert.pem, key.pem, ca.pem
    else No CA
      T2-->>H: items include cert.pem, key.pem
    end
  else TLS disabled
    T2-->>H: No TLS secret volume/items
  end

  H->>K: Apply rendered manifests
  K-->>H: Resources created/updated

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• Bump k8s-infra charts version #524 — Also updates charts/k8s-infra/Chart.yaml version; overlaps with this chart version change.

Suggested reviewers

• srikanthccv
• prashant-shahi
• nityanandagohain

Poem

A whisk of charts, a hop of keys,
Now CA joins the TLS breeze.
cert, key, and ca in a tidy set—
Helm renders what the burrow expects.
0.14.2, we leap anew,
🐰 shipping manifests crisp and true.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title clearly indicates that a CA certificate mount is being added for the k8s-infra chart, corresponding directly to the changes in the otel-agent and otel-deployment templates. It uses a conventional commit prefix to denote the type of change. The phrasing is concise and specific, enabling quick comprehension without extraneous detail.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e38b2da and 24606a5.

📒 Files selected for processing (3)

• charts/k8s-infra/Chart.yaml (1 hunks)
• charts/k8s-infra/templates/otel-agent/daemonset.yaml (1 hunks)
• charts/k8s-infra/templates/otel-deployment/deployment.yaml (1 hunks)

🧰 Additional context used

🧠 Learnings (2)

📚 Learning: 2024-09-17T09:57:12.685Z

Learnt from: grandwizard28
PR: SigNoz/charts#501
File: charts/k8s-infra/Chart.yaml:5-5
Timestamp: 2024-09-17T09:57:12.685Z
Learning: When updating the version in `charts/k8s-infra/Chart.yaml`, ensure that the version increment reflects the scope of changes made. For minor changes, increment the patch version (e.g., from `0.11.10` to `0.11.11`).

Applied to files:

• charts/k8s-infra/Chart.yaml

📚 Learning: 2024-10-16T19:01:15.514Z

Learnt from: grandwizard28
PR: SigNoz/charts#0
File: :0-0
Timestamp: 2024-10-16T19:01:15.514Z
Learning: When updating the version in `charts/k8s-infra/Chart.yaml`, use version `0.11.11` instead of `0.11.20` as per the user's guidance.

Applied to files:

• charts/k8s-infra/Chart.yaml

🔇 Additional comments (3)

charts/k8s-infra/Chart.yaml (1)

5-5: Patch bump matches change scope.
Incrementing to 0.14.2 keeps this TLS secret tweak in the patch range as previously requested. Based on learnings

charts/k8s-infra/templates/otel-agent/daemonset.yaml (1)

63-74: TLS secret now exposes ca.pem when provided.
The conditional ca.pem item lines up with cert/key handling, so the agent will see the CA only when configured. Nicely done.

charts/k8s-infra/templates/otel-deployment/deployment.yaml (1)

56-67: Deployment mount stays consistent with agent.
Mirroring the ca.pem conditional here keeps both workloads aligned and prevents missing-key errors when the CA is absent.

Tip

👮 Agentic pre-merge checks are now available in preview!

Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.

• Built-in checks – Quickly apply ready-made checks to enforce title conventions, require pull request descriptions that follow templates, validate linked issues for compliance, and more.
• Custom agentic checks – Define your own rules using CodeRabbit’s advanced agentic capabilities to enforce organization-specific policies and workflows. For example, you can instruct CodeRabbit’s agent to verify that API documentation is updated whenever API schema files are modified in a PR. Note: Upto 5 custom checks are currently allowed during the preview period. Pricing for this feature will be announced in a few weeks.

Please see the documentation for more information.

Example:

reviews:
  pre_merge_checks:
    custom_checks:
      - name: "Undocumented Breaking Changes"
        mode: "warning"
        instructions: |
          Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).

Please share your feedback with us on this Discord post.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[benoit-serie]

👋 Can confirm this bug is blocking real-world usage.

Reproducing the issue:
When configuring client-side TLS verification (CA certificate only, no client cert/key):

otelInsecure: false
insecureSkipVerify: false
otelTlsSecrets:
  enabled: true
  certificate: ""
  key: ""
  ca: |
    <CA_CERTIFICATE>

Error encountered:

  failed to load CA CertPool File: failed to load cert /secrets/ca.pem:
  no such file or directory

followed by:

  tls: failed to verify certificate: x509: certificate signed by unknown authority

Impact:
This prevents using the k8s-infra chart with proper TLS certificate verification when connecting to secure OTLP
endpoints - a critical security feature.

Current workaround:
Either:

1. Set insecureSkipVerify: true (defeats purpose of TLS)
2. Use complex extraVolumes override (non-intuitive, did not success implement it)

This PR would fix the issue properly. Could this be prioritized for merge? Happy to test the fix.