tree 757fc49d10218a32352ec65b76ab434bb53138de
parent fcfe8f33e280b3896e18de98daa3da6d0aa730c1
author Wendy <wendy.wang10@sap.com> 1788870631 +0200
committer Wendy <wendy.wang10@sap.com> 1789647857 +0200

TLS cert support for GerritIndexer remote index backends

The GerritIndexer had no mechanism to provide CA certificates when
running a reindex job against a remote index backend that uses
non-publicly-trusted TLS certificates. This caused both the Python
init container and the Java reindex process to fail with SSL
verification errors.

Add openSearchSecretRef field to GerritIndexerSpec, containing a
secret with optional keys:
- A CA certificate in PEM format (ca.crt) for Python SSL verification
  in the gerrit-init container, mounted at /var/config/ca.crt
- A Java truststore in JKS format (truststore.jks) for Java SSL
  verification by the reindex process, mounted at
  /var/mnt/data/index-opensearch/

The gerrit-init-config ConfigMap mount is changed to use subPath so
that the CA certificate can be mounted alongside it in /var/config/.

Change-Id: I00a8043256c001ffa0b91bb30815511ccfd9d13f