[AAP-89728]fix: mounts the ca bundle correctly and does some DRY work

[AlexSCorey]

addresses AAP-89728 and properly mounts the ca-bundle to the eda-api pod. It also does a little refactoring to dry out some templating that is used by the eda-api and the daphne pods.

Summary by CodeRabbit

• New Features

  • Added optional mounting of the CA trust directory and bundle certificate into containers.
  • Mounted the bundle certificate as read-only when CA bundling is enabled.

• Refactor

  • Standardized CA certificate volume mounts across API and Daphne containers for more consistent configuration.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 8c3135de-1e85-420f-9eb0-d102056f04a8

📥 Commits

Reviewing files that changed from the base of the PR and between cd0d211 and 982a7c2.

📒 Files selected for processing (2)

• roles/eda/templates/ca-mount-fragment.yaml.j2
• roles/eda/templates/eda-api.deployment.yaml.j2

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The deployment templates add a shared conditional CA mount fragment and use it for the API and Daphne containers.

Changes

CA mount integration

Layer / File(s)	Summary
Define conditional CA mounts roles/eda/templates/ca-mount-fragment.yaml.j2	Adds mounts for the extracted CA trust directory and bundle CA certificate when bundle_ca_crt is enabled.
Wire mounts into deployment containers roles/eda/templates/eda-api.deployment.yaml.j2	Replaces the API and Daphne inline CA mount definitions with the shared template lookup.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 982a7

The change mounts the CA bundle for the EDA API pod and simplifies related deployment templates; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: dsavineau, aldato

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the CA bundle mounting fix and the DRY refactor described in the changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 89728-mount-CA-bundle

---

_{Comment @coderabbitai help to get the list of available commands.}

[kaiokmo]

I'm confused. Why's this needed? I thought the issue of the CA bundle not being attached to the api pods was previously resolved on #342, and also previously reported on AAP-72822.

I understand the refactor itself here, but I don't see how that fixes an issue that was supposed to be already resolved.

On another note, AAP-89728 mentions that it doesn't attach the CA Bundle to the EDA API Pods. This is not true. See:

eda-server-operator/roles/eda/templates/eda-api.deployment.yaml.j2

Lines 365 to 372 in cd0d211

	{% if bundle_ca_crt %}
	- name: "ca-trust-extracted"
	mountPath: "/etc/pki/ca-trust/extracted"
	- name: "{{ ansible_operator_meta.name }}-bundle-cacert"
	mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
	subPath: bundle-ca.crt
	readOnly: true
	{% endif %}

[AlexSCorey]

I'm confused. Why's this needed? I thought the issue of the CA bundle not being attached to the api pods was previously resolved on #342, and also previously reported on AAP-72822.

I understand the refactor itself here, but I don't see how that fixes an issue that was supposed to be already resolved.

On another note, AAP-89728 mentions that it doesn't attach the CA Bundle to the EDA API Pods. This is not true. See:

eda-server-operator/roles/eda/templates/eda-api.deployment.yaml.j2

Lines 365 to 372 in cd0d211

	{% if bundle_ca_crt %}
	- name: "ca-trust-extracted"
	mountPath: "/etc/pki/ca-trust/extracted"
	- name: "{{ ansible_operator_meta.name }}-bundle-cacert"
	mountPath: /etc/pki/ca-trust/source/anchors/bundle-ca.crt
	subPath: bundle-ca.crt
	readOnly: true
	{% endif %}

@kaiokmo Apparently it was not being mounted in the api pod. https://redhat.atlassian.net/browse/AAP-89728

[AlexSCorey]

This change isn't needed. Closing.