Add the ability to use a caFile in tls sections (#1013)

Signed-off-by: Pete Wall <pete.wall@grafana.com>
grafana · Dec 19, 2024 · 39996f5 · 39996f5
1 parent 979dbde
commit 39996f5
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 4 deletions.
diff --git a/charts/k8s-monitoring/templates/destinations/_destination_loki.tpl b/charts/k8s-monitoring/templates/destinations/_destination_loki.tpl
@@ -74,7 +74,9 @@ loki.write {{ include "helper.alloy_name" .name | quote }} {
 {{- if .tls }}
     tls_config {
       insecure_skip_verify = {{ .tls.insecureSkipVerify | default false }}
-      {{- if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.ca")) "true" }}
+      {{- if .tls.caFile }}
+      ca_file = {{ .tls.caFile | quote }}
+      {{- else if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.ca")) "true" }}
       ca_pem = {{ include "secrets.read" (dict "object" . "key" "tls.ca" "nonsensitive" true) }}
       {{- end }}
       {{- if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.cert")) "true" }}

diff --git a/charts/k8s-monitoring/templates/destinations/_destination_otlp.tpl b/charts/k8s-monitoring/templates/destinations/_destination_otlp.tpl
@@ -299,7 +299,9 @@ otelcol.exporter.otlphttp {{ include "helper.alloy_name" .name | quote }} {
     tls {
       insecure = {{ .tls.insecure | default false }}
       insecure_skip_verify = {{ .tls.insecureSkipVerify | default false }}
-      {{- if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.ca")) "true" }}
+      {{- if .tls.caFile }}
+      ca_file = {{ .tls.caFile | quote }}
+      {{- else if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.ca")) "true" }}
       ca_pem = {{ include "secrets.read" (dict "object" . "key" "tls.ca" "nonsensitive" true) }}
       {{- end }}
       {{- if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.cert")) "true" }}

diff --git a/charts/k8s-monitoring/templates/destinations/_destination_prometheus.tpl b/charts/k8s-monitoring/templates/destinations/_destination_prometheus.tpl
@@ -93,7 +93,9 @@ prometheus.remote_write {{ include "helper.alloy_name" .name | quote }} {
 {{- if .tls }}
     tls_config {
       insecure_skip_verify = {{ .tls.insecureSkipVerify | default false }}
-      {{- if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.ca")) "true" }}
+      {{- if .tls.caFile }}
+      ca_file = {{ .tls.caFile | quote }}
+      {{- else if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.ca")) "true" }}
       ca_pem = {{ include "secrets.read" (dict "object" . "key" "tls.ca" "nonsensitive" true) }}
       {{- end }}
       {{- if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.cert")) "true" }}

diff --git a/charts/k8s-monitoring/templates/destinations/_destination_pyroscope.tpl b/charts/k8s-monitoring/templates/destinations/_destination_pyroscope.tpl
@@ -66,7 +66,9 @@ pyroscope.write {{ include "helper.alloy_name" .name | quote }} {
 {{- if .tls }}
     tls_config {
       insecure_skip_verify = {{ .tls.insecureSkipVerify | default false }}
-      {{- if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.ca")) "true" }}
+      {{- if .tls.caFile }}
+      ca_file = {{ .tls.caFile | quote }}
+      {{- else if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.ca")) "true" }}
       ca_pem = {{ include "secrets.read" (dict "object" . "key" "tls.ca" "nonsensitive" true) }}
       {{- end }}
       {{- if eq (include "secrets.usesSecret" (dict "object" . "key" "tls.cert")) "true" }}