Add support for an external proxy (#345)

* Add proxy for values.yaml * Add missing metadata for podBudgetDisruption * Update values.yaml * Add support for an external proxy * Add proxy support for all components * Always set both HTTP_PROXY and HTTPS_PROXY * Add docs * Add http_proxy, https_proxy, and no_proxy env vars * Remove user/password configuration * Replace EXTRA_CA_CERTS in favor of NODE_EXTRA_CA_CERTS * Add GRPC_PROXY and grpc_proxy env vars
CartoDB · May 12, 2023 · e3e527d · e3e527d
1 parent ec650a0
commit e3e527d
Show file tree

Hide file tree

Showing 24 changed files with 393 additions and 19 deletions.
diff --git a/chart/README.md b/chart/README.md
diff --git a/chart/templates/_helpers.tpl b/chart/templates/_helpers.tpl
@@ -1337,3 +1337,39 @@ Return the proper Carto upgrade check image name
 {{- define "carto.upgradeCheck.image" -}}
 {{- include "carto.images.image" (dict "imageRoot" .Values.upgradeCheck.image "global" .Values.global "Chart" .Chart) -}}
 {{- end -}}
+
+{{/*
+Add environment variables to configure proxy values
+FIXME: Add support for user and password
+*/}}
+{{- define "carto.proxy.connectionString" -}}
+{{- printf "%s://%s:%d" (lower .Values.externalProxy.type) .Values.externalProxy.host (int .Values.externalProxy.port) -}}
+{{- end -}}
+
+{{/*
+Get the proxy config map name
+*/}}
+{{- define "carto.proxy.configMapName" -}}
+{{- printf "%s-%s" .Release.Name "externalproxy" -}}
+{{- end -}}
+
+{{/*
+Return the directory where the proxy CA cert will be mounted
+*/}}
+{{- define "carto.proxy.configMapMountDir" -}}
+{{- print "/usr/src/certs/proxy-ssl-ca" -}}
+{{- end -}}
+
+{{/*
+Return the filename where the proxy CA will be mounted
+*/}}
+{{- define "carto.proxy.configMapMountFilename" -}}
+{{- print "ca.crt" -}}
+{{- end -}}
+
+{{/*
+Return the absolute path where the proxy CA cert will be mounted
+*/}}
+{{- define "carto.proxy.configMapMountAbsolutePath" -}}
+{{- printf "%s/%s" (include "carto.proxy.configMapMountDir" .) (include "carto.proxy.configMapMountFilename" .) -}}
+{{- end -}}
diff --git a/chart/templates/cdn-invalidator-sub/configmap.yaml b/chart/templates/cdn-invalidator-sub/configmap.yaml
@@ -24,4 +24,20 @@ data:
   GOOGLE_APPLICATION_CREDENTIALS: {{ include "carto.google.secretMountAbsolutePath" . }}
   {{- end }}
   PUBSUB_PROJECT_ID: {{ .Values.cartoConfigValues.selfHostedGcpProjectId | quote }}
+  {{- if .Values.externalProxy.enabled }}
+  HTTP_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  http_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  HTTPS_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  https_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  GRPC_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  grpc_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  NODE_TLS_REJECT_UNAUTHORIZED: {{ ternary "1" "0" .Values.externalProxy.sslRejectUnauthorized | quote }}
+  {{- if gt (len .Values.externalProxy.excludedDomains) 0 }}
+  NO_PROXY: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  no_proxy: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  {{- end }}
+  {{- if .Values.externalProxy.sslCA }}
+  NODE_EXTRA_CA_CERTS: {{ include "carto.proxy.configMapMountAbsolutePath" . | quote }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/chart/templates/cdn-invalidator-sub/deployment.yaml b/chart/templates/cdn-invalidator-sub/deployment.yaml
@@ -163,6 +163,11 @@ spec:
             - name: gcp-default-service-account-key
               mountPath: {{ include "carto.google.secretMountDir" . }}
               readOnly: true
+            {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+            - name: proxy-ssl-ca
+              mountPath: {{ include "carto.proxy.configMapMountDir" . }}
+              readOnly: true
+            {{- end }}
           {{- if .Values.cdnInvalidatorSub.extraVolumeMounts }}
           {{- include "common.tplvalues.render" (dict "value" .Values.cdnInvalidatorSub.extraVolumeMounts "context" $) | nindent 12 }}
           {{- end }}
@@ -176,6 +181,11 @@ spec:
             items:
               - key: {{ include "carto.google.secretKey" . }}
                 path: {{ include "carto.google.secretMountFilename" . }}
+        {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+        - name: proxy-ssl-ca
+          configMap:
+            name: {{ include "carto.proxy.configMapName" . }}
+        {{- end }}
         {{- if .Values.cdnInvalidatorSub.extraVolumes }}
         {{- include "common.tplvalues.render" (dict "value" .Values.cdnInvalidatorSub.extraVolumes "context" $) | nindent 8 }}
         {{- end }}

diff --git a/chart/templates/externalproxy-configmap.yaml b/chart/templates/externalproxy-configmap.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "carto.proxy.configMapName" . }}
+  labels: {{- include "common.labels.standard" . | nindent 4 }}
+    {{- if .Values.commonLabels }}
+    {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }}
+    {{- end }}
+  namespace: {{ .Release.Namespace | quote }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
+  {{- end }}
+data:
+  {{ include "carto.proxy.configMapMountFilename" . }}: {{ .Values.externalProxy.sslCA | quote }}
+{{- end }}
diff --git a/chart/templates/import-api/configmap.yaml b/chart/templates/import-api/configmap.yaml
@@ -57,4 +57,20 @@ data:
   {{- if eq .Values.appConfigValues.storageProvider "azure-blob" }}
   IMPORT_STORAGE_ACCOUNT: {{ .Values.appConfigValues.azureStorageAccount | quote }}
   {{- end }}
+  {{- if .Values.externalProxy.enabled }}
+  HTTP_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  http_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  HTTPS_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  https_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  GRPC_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  grpc_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  NODE_TLS_REJECT_UNAUTHORIZED: {{ ternary "1" "0" .Values.externalProxy.sslRejectUnauthorized | quote }}
+  {{- if gt (len .Values.externalProxy.excludedDomains) 0 }}
+  NO_PROXY: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  no_proxy: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  {{- end }}
+  {{- if .Values.externalProxy.sslCA }}
+  NODE_EXTRA_CA_CERTS: {{ include "carto.proxy.configMapMountAbsolutePath" . | quote }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/chart/templates/import-api/deployment.yaml b/chart/templates/import-api/deployment.yaml
@@ -201,6 +201,11 @@ spec:
               mountPath: {{ include "carto.redis.configMapMountDir" . }}
               readOnly: true
             {{- end }}
+            {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+            - name: proxy-ssl-ca
+              mountPath: {{ include "carto.proxy.configMapMountDir" . }}
+              readOnly: true
+            {{- end }}
           {{- if .Values.importApi.extraVolumeMounts }}
           {{- include "common.tplvalues.render" (dict "value" .Values.importApi.extraVolumeMounts "context" $) | nindent 12 }}
           {{- end }}
@@ -232,6 +237,11 @@ spec:
           configMap:
             name: {{ include "carto.redis.configMapName" . }}
         {{- end }}
+        {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+        - name: proxy-ssl-ca
+          configMap:
+            name: {{ include "carto.proxy.configMapName" . }}
+        {{- end }}
         {{- if .Values.importApi.extraVolumes }}
         {{- include "common.tplvalues.render" (dict "value" .Values.importApi.extraVolumes "context" $) | nindent 8 }}
         {{- end }}

diff --git a/chart/templates/import-worker/configmap.yaml b/chart/templates/import-worker/configmap.yaml
@@ -53,4 +53,20 @@ data:
   {{- if eq .Values.appConfigValues.storageProvider "azure-blob" }}
   IMPORT_STORAGE_ACCOUNT: {{ .Values.appConfigValues.azureStorageAccount | quote }}
   {{- end }}
+  {{- if .Values.externalProxy.enabled }}
+  HTTP_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  http_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  HTTPS_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  https_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  GRPC_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  grpc_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  NODE_TLS_REJECT_UNAUTHORIZED: {{ ternary "1" "0" .Values.externalProxy.sslRejectUnauthorized | quote }}
+  {{- if gt (len .Values.externalProxy.excludedDomains) 0 }}
+  NO_PROXY: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  no_proxy: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  {{- end }}
+  {{- if .Values.externalProxy.sslCA }}
+  NODE_EXTRA_CA_CERTS: {{ include "carto.proxy.configMapMountAbsolutePath" . | quote }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/chart/templates/import-worker/deployment.yaml b/chart/templates/import-worker/deployment.yaml
@@ -176,6 +176,11 @@ spec:
               mountPath: {{ include "carto.postgresql.configMapMountDir" . }}
               readOnly: true
             {{- end }}
+            {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+            - name: proxy-ssl-ca
+              mountPath: {{ include "carto.proxy.configMapMountDir" . }}
+              readOnly: true
+            {{- end }}
           {{- if .Values.importWorker.extraVolumeMounts }}
           {{- include "common.tplvalues.render" (dict "value" .Values.importWorker.extraVolumeMounts "context" $) | nindent 12 }}
           {{- end }}
@@ -202,6 +207,11 @@ spec:
           configMap:
             name: {{ include "carto.postgresql.configMapName" . }}
         {{- end }}
+        {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+        - name: proxy-ssl-ca
+          configMap:
+            name: {{ include "carto.proxy.configMapName" . }}
+        {{- end }}
         {{- if .Values.importWorker.extraVolumes }}
         {{- include "common.tplvalues.render" (dict "value" .Values.importWorker.extraVolumes "context" $) | nindent 8 }}
         {{- end }}

diff --git a/chart/templates/lds-api/configmap.yaml b/chart/templates/lds-api/configmap.yaml
@@ -41,4 +41,20 @@ data:
   WORKSPACE_POSTGRES_SSL_CA: {{ include "carto.postgresql.configMapMountAbsolutePath" . }}
   {{- end }}
   LDS_TENANT_ID: {{ .Values.cartoConfigValues.selfHostedTenantId | quote }}
+  {{- if .Values.externalProxy.enabled }}
+  HTTP_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  http_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  HTTPS_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  https_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  GRPC_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  grpc_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  NODE_TLS_REJECT_UNAUTHORIZED: {{ ternary "1" "0" .Values.externalProxy.sslRejectUnauthorized | quote }}
+  {{- if gt (len .Values.externalProxy.excludedDomains) 0 }}
+  NO_PROXY: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  no_proxy: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  {{- end }}
+  {{- if .Values.externalProxy.sslCA }}
+  NODE_EXTRA_CA_CERTS: {{ include "carto.proxy.configMapMountAbsolutePath" . | quote }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/chart/templates/lds-api/deployment.yaml b/chart/templates/lds-api/deployment.yaml
@@ -186,6 +186,11 @@ spec:
               mountPath: {{ include "carto.redis.configMapMountDir" . }}
               readOnly: true
             {{- end }}
+            {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+            - name: proxy-ssl-ca
+              mountPath: {{ include "carto.proxy.configMapMountDir" . }}
+              readOnly: true
+            {{- end }}
           {{- if .Values.ldsApi.extraVolumeMounts }}
           {{- include "common.tplvalues.render" (dict "value" .Values.ldsApi.extraVolumeMounts "context" $) | nindent 12 }}
           {{- end }}
@@ -209,6 +214,11 @@ spec:
           configMap:
             name: {{ include "carto.redis.configMapName" . }}
         {{- end }}
+        {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+        - name: proxy-ssl-ca
+          configMap:
+            name: {{ include "carto.proxy.configMapName" . }}
+        {{- end }}
         {{- if .Values.ldsApi.extraVolumes }}
         {{- include "common.tplvalues.render" (dict "value" .Values.ldsApi.extraVolumes "context" $) | nindent 8 }}
         {{- end }}

diff --git a/chart/templates/maps-api/configmap.yaml b/chart/templates/maps-api/configmap.yaml
@@ -48,4 +48,20 @@ data:
   {{- if and .Values.externalPostgresql.sslEnabled .Values.externalPostgresql.sslCA  }}
   WORKSPACE_POSTGRES_SSL_CA: {{ include "carto.postgresql.configMapMountAbsolutePath" . }}
   {{- end }}
+  {{- if .Values.externalProxy.enabled }}
+  HTTP_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  http_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  HTTPS_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  https_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  GRPC_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  grpc_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  NODE_TLS_REJECT_UNAUTHORIZED: {{ ternary "1" "0" .Values.externalProxy.sslRejectUnauthorized | quote }}
+  {{- if gt (len .Values.externalProxy.excludedDomains) 0 }}
+  NO_PROXY: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  no_proxy: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  {{- end }}
+  {{- if .Values.externalProxy.sslCA }}
+  NODE_EXTRA_CA_CERTS: {{ include "carto.proxy.configMapMountAbsolutePath" . | quote }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/chart/templates/maps-api/deployment.yaml b/chart/templates/maps-api/deployment.yaml
@@ -188,6 +188,11 @@ spec:
               mountPath: {{ include "carto.redis.configMapMountDir" . }}
               readOnly: true
             {{- end }}
+            {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+            - name: proxy-ssl-ca
+              mountPath: {{ include "carto.proxy.configMapMountDir" . }}
+              readOnly: true
+            {{- end }}
           {{- if .Values.mapsApi.extraVolumeMounts }}
           {{- include "common.tplvalues.render" (dict "value" .Values.mapsApi.extraVolumeMounts "context" $) | nindent 12 }}
           {{- end }}
@@ -211,6 +216,11 @@ spec:
           configMap:
             name: {{ include "carto.redis.configMapName" . }}
         {{- end }}
+        {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+        - name: proxy-ssl-ca
+          configMap:
+            name: {{ include "carto.proxy.configMapName" . }}
+        {{- end }}
         {{- if .Values.mapsApi.extraVolumes }}
         {{- include "common.tplvalues.render" (dict "value" .Values.mapsApi.extraVolumes "context" $) | nindent 8 }}
       {{- end }}

diff --git a/chart/templates/router/configmap.yaml b/chart/templates/router/configmap.yaml
@@ -34,4 +34,20 @@ data:
   ROUTER_METRICS_PUBSUB_TOPIC: "data-updates"
   ROUTER_METRICS_HOST: "localhost"
   ROUTER_METRICS_PUBSUB_SUBSCRIPTION_FILTER: "aggregated-selfhosted-metrics"
+  {{- if .Values.externalProxy.enabled }}
+  HTTP_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  http_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  HTTPS_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  https_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  GRPC_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  grpc_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  NODE_TLS_REJECT_UNAUTHORIZED: {{ ternary "1" "0" .Values.externalProxy.sslRejectUnauthorized | quote }}
+  {{- if gt (len .Values.externalProxy.excludedDomains) 0 }}
+  NO_PROXY: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  no_proxy: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  {{- end }}
+  {{- if .Values.externalProxy.sslCA }}
+  NODE_EXTRA_CA_CERTS: {{ include "carto.proxy.configMapMountAbsolutePath" . | quote }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/chart/templates/sql-worker/configmap.yaml b/chart/templates/sql-worker/configmap.yaml
@@ -47,4 +47,20 @@ data:
   WORKSPACE_POSTGRES_SSL_CA: {{ include "carto.postgresql.configMapMountAbsolutePath" . }}
   {{- end }}
   WORKSPACE_TENANT_ID: {{ .Values.cartoConfigValues.selfHostedTenantId | quote }}
+  {{- if .Values.externalProxy.enabled }}
+  HTTP_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  http_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  HTTPS_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  https_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  GRPC_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  grpc_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  NODE_TLS_REJECT_UNAUTHORIZED: {{ ternary "1" "0" .Values.externalProxy.sslRejectUnauthorized | quote }}
+  {{- if gt (len .Values.externalProxy.excludedDomains) 0 }}
+  NO_PROXY: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  no_proxy: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  {{- end }}
+  {{- if .Values.externalProxy.sslCA }}
+  NODE_EXTRA_CA_CERTS: {{ include "carto.proxy.configMapMountAbsolutePath" . | quote }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/chart/templates/sql-worker/deployment.yaml b/chart/templates/sql-worker/deployment.yaml
@@ -161,6 +161,11 @@ spec:
               mountPath: {{ include "carto.postgresql.configMapMountDir" . }}
               readOnly: true
             {{- end }}
+            {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+            - name: proxy-ssl-ca
+              mountPath: {{ include "carto.proxy.configMapMountDir" . }}
+              readOnly: true
+            {{- end }}
           {{- if .Values.sqlWorker.extraVolumeMounts }}
           {{- include "common.tplvalues.render" (dict "value" .Values.sqlWorker.extraVolumeMounts "context" $) | nindent 12 }}
           {{- end }}
@@ -187,6 +192,11 @@ spec:
           configMap:
             name: {{ include "carto.postgresql.configMapName" . }}
         {{- end }}
+        {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+        - name: proxy-ssl-ca
+          configMap:
+            name: {{ include "carto.proxy.configMapName" . }}
+        {{- end }}
         {{- if .Values.sqlWorker.extraVolumes }}
         {{- include "common.tplvalues.render" (dict "value" .Values.sqlWorker.extraVolumes "context" $) | nindent 8 }}
         {{- end }}

diff --git a/chart/templates/workspace-api/configmap.yaml b/chart/templates/workspace-api/configmap.yaml
@@ -86,4 +86,20 @@ data:
   WORKSPACE_THUMBNAILS_STORAGE_ACCOUNT: {{ .Values.appConfigValues.azureStorageAccount | quote }}
   WORKSPACE_IMPORTS_STORAGE_ACCOUNT: {{ .Values.appConfigValues.azureStorageAccount | quote }}
   {{- end }}
+  {{- if .Values.externalProxy.enabled }}
+  HTTP_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  http_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  HTTPS_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  https_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  GRPC_PROXY: {{ include "carto.proxy.connectionString" . | quote }}
+  grpc_proxy: {{ include "carto.proxy.connectionString" . | quote }}
+  NODE_TLS_REJECT_UNAUTHORIZED: {{ ternary "1" "0" .Values.externalProxy.sslRejectUnauthorized | quote }}
+  {{- if gt (len .Values.externalProxy.excludedDomains) 0 }}
+  NO_PROXY: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  no_proxy: {{ join "," .Values.externalProxy.excludedDomains | quote }}
+  {{- end }}
+  {{- if .Values.externalProxy.sslCA }}
+  NODE_EXTRA_CA_CERTS: {{ include "carto.proxy.configMapMountAbsolutePath" . | quote }}
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/chart/templates/workspace-api/deployment.yaml b/chart/templates/workspace-api/deployment.yaml
@@ -279,6 +279,11 @@ spec:
               mountPath: {{ include "carto.redis.configMapMountDir" . }}
               readOnly: true
             {{- end }}
+            {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+            - name: proxy-ssl-ca
+              mountPath: {{ include "carto.proxy.configMapMountDir" . }}
+              readOnly: true
+            {{- end }}
           {{- if .Values.workspaceApi.extraVolumeMounts }}
           {{- include "common.tplvalues.render" (dict "value" .Values.workspaceApi.extraVolumeMounts "context" $) | nindent 12 }}
           {{- end }}
@@ -310,6 +315,11 @@ spec:
           configMap:
             name: {{ include "carto.redis.configMapName" . }}
         {{- end }}
+        {{- if and .Values.externalProxy.enabled .Values.externalProxy.sslCA }}
+        - name: proxy-ssl-ca
+          configMap:
+            name: {{ include "carto.proxy.configMapName" . }}
+        {{- end }}
         {{- if .Values.workspaceApi.extraVolumes }}
         {{- include "common.tplvalues.render" (dict "value" .Values.workspaceApi.extraVolumes "context" $) | nindent 8 }}
         {{- end }}