Keep client CAs as a K8s ConfigMap.

The CAs used to verify clients are not secrets and can be committed to
the repository as K8s ConfigMaps. This updates the config to include
them.

deploy/README.md

@@ -62,24 +62,6 @@ Notes:
 - Be careful not to check the override.ini file into source control.
 - Be careful not to overwrite one CSP cluster's config with the other's. This will break everything.
 
-### nginx-client-ca-bundle
-
-(NOTE: This really doesn't need to be a secret since these are public certs. A good change would be to convert it to a k8s configmap.)
-
-This is the PEM certificate file of the DoD Certificate Authority certs. This must be available for CAC authentication.
-
-A local copy of the certs are stored in the repo at `ssl/client-certs/ca-chain.pem`. It can be updated by running `script/sync-dod-certs`. When creating a new cluster, you can copy the cert file to the repo root:
-
-```
-cp ssl/client-certs/ca-chain.pem client-ca-bundle.pem
-```
-
-and then create a new secret from it:
-
-```
-kubectl -n atat create secret generic nginx-client-ca-bundle --from-file=./client-ca-bundle.pem
-```
-
 ### nginx-htpasswd
 
 If the site is running in dev mode, the `/login-dev` endpoint is available. This endpoint is protected by basic HTTP auth. To create a new password file, run:

deploy/azure/azure.yml

@@ -79,12 +79,9 @@ spec:
               path: atst-overrides.ini
               mode: 0644
         - name: nginx-client-ca-bundle
-          secret:
+          configMap:
-            secretName: nginx-client-ca-bundle
+            name: nginx-client-ca-bundle
-            items:
+            defaultMode: 0666
-            - key: client-ca-bundle.pem
-              path: client-ca-bundle.pem
-              mode: 0666
         - name: nginx-config
           configMap:
             name: atst-nginx

deploy/minikube/minikube.yml

@@ -69,12 +69,9 @@ spec:
               path: atst-overrides.ini
               mode: 0644
         - name: nginx-client-ca-bundle
-          secret:
+          configMap:
-            secretName: nginx-client-ca-bundle
+            name: nginx-client-ca-bundle
-            items:
+            defaultMode: 0666
-            - key: client-ca-bundle.pem
-              path: client-ca-bundle.pem
-              mode: 0666
         - name: nginx-config
           configMap:
             name: atst-nginx