Fix support PostgreSQL CA bundle in Helm charts with file path option

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

contrib/helm/charts/probo/README.md

@@ -155,6 +155,8 @@ The following parameters **must** be configured:
 | `postgresql.port`      | PostgreSQL port                 | `5432` |
 | `postgresql.database`  | Database name                   | `probod` |
 | `postgresql.username`  | Database user                   | `probod` |
+| `postgresql.caBundle`  | PostgreSQL TLS CA certificate bundle (inline) | `""` |
+| `postgresql.caBundlePath` | PostgreSQL TLS CA certificate bundle (file path) | `""` |
 | `s3.bucket`            | S3 bucket name                  | `probod` |
 | `s3.region`            | AWS region                      | `us-east-1` |
 | `s3.endpoint`          | S3 endpoint (for S3-compatible) | `""` |
@@ -183,6 +185,38 @@ The chart deploys the following:
 
 Database migrations run automatically when Probo starts. No manual intervention is required.
 
+### TLS/SSL Configuration
+
+For secure PostgreSQL connections, you can provide a CA certificate bundle in two ways:
+
+1. **Inline CA Bundle** (`postgresql.caBundle`): Provide the certificate content directly in values.yaml
+   ```yaml
+   postgresql:
+     caBundle: |
+       -----BEGIN CERTIFICATE-----
+       MIIEDzCCAvegAwIBAgIBADANBgkqhkiG9w0BAQUFADBoMQswCQYDVQQGEwJVUzEl
+       ...
+       -----END CERTIFICATE-----
+   ```
+
+2. **File Path** (`postgresql.caBundlePath`): Mount the CA bundle as a ConfigMap/Secret and reference the path
+   ```yaml
+   postgresql:
+     caBundlePath: /etc/ssl/certs/ca-certificates.crt
+
+   # Then mount your CA bundle using volumes/volumeMounts
+   volumes:
+     - name: ca-bundle
+       configMap:
+         name: postgres-ca-bundle
+   volumeMounts:
+     - name: ca-bundle
+       mountPath: /etc/ssl/certs
+       readOnly: true
+   ```
+
+**Note:** Using `caBundlePath` is recommended for large CA bundles (e.g., system CA bundles) as it avoids environment variable size limitations.
+
 ### Backup
 
 Use your PostgreSQL provider's backup solution (e.g., AWS RDS automated backups, GCP Cloud SQL backups).
@@ -232,6 +266,11 @@ Check the Probo logs for S3 connection errors when uploading files.
 postgresql:
   host: "mydb.abc123.us-east-1.rds.amazonaws.com"
   password: "<rds-password>"
+  # Optional: Add RDS CA bundle for TLS connections
+  # caBundle: |
+  #   -----BEGIN CERTIFICATE-----
+  #   ...RDS CA certificate...
+  #   -----END CERTIFICATE-----
 
 s3:
   region: "us-east-1"

contrib/helm/charts/probo/templates/deployment.yaml

@@ -85,6 +85,16 @@ spec:
               value: {{ include "probo.postgresql.database" . | quote }}
             - name: PG_POOL_SIZE
               value: {{ .Values.postgresql.poolSize | default "100" | quote }}
+            {{- if .Values.postgresql.caBundle }}
+            - name: PG_CA_BUNDLE
+              valueFrom:
+                secretKeyRef:
+                  name: {{ include "probo.fullname" . }}
+                  key: pg-ca-bundle
+            {{- else if .Values.postgresql.caBundlePath }}
+            - name: PG_CA_BUNDLE_PATH
+              value: {{ .Values.postgresql.caBundlePath | quote }}
+            {{- end }}
             # Authentication
             - name: AUTH_DISABLE_SIGNUP
               value: {{ .Values.probo.auth.disableSignup | quote }}

contrib/helm/charts/probo/templates/secret.yaml

@@ -8,6 +8,9 @@ type: Opaque
 stringData:
   # Database credentials
   db-password: {{ if .Values.postgresql.enabled }}{{ .Values.postgresql.auth.postgresPassword | quote }}{{ else }}{{ required "postgresql.password is required when postgresql.enabled=false" .Values.postgresql.password | quote }}{{ end }}
+  {{- if .Values.postgresql.caBundle }}
+  pg-ca-bundle: {{ .Values.postgresql.caBundle | quote }}
+  {{- end }}
 
   # S3 credentials
   s3-access-key: {{ include "probo.s3.accessKeyId" . | quote }}

contrib/helm/charts/probo/values.yaml

@@ -297,6 +297,13 @@ postgresql:
   password: ""  # REQUIRED when enabled=false: PostgreSQL password
   database: probod
   poolSize: 100
+  # PostgreSQL TLS/SSL configuration
+  # caBundle: |
+  #   -----BEGIN CERTIFICATE-----
+  #   ...certificate content...
+  #   -----END CERTIFICATE-----
+  # Or use caBundlePath to mount from a ConfigMap/Secret
+  # caBundlePath: /etc/ssl/certs/ca-certificates.crt
 
 # S3 storage configuration
 # For production: Use external S3 (AWS S3, GCS, etc.)

docs/CONFIGURATION.md

@@ -325,6 +325,20 @@ Maximum number of database connections in the connection pool.
 
 PEM-encoded CA certificate bundle for TLS database connections. Required when connecting to databases with custom or self-signed certificates.
 
+**Environment Variable Options:**
+
+- `PG_CA_BUNDLE`: Provide the CA bundle content directly as an environment variable (suitable for smaller bundles)
+- `PG_CA_BUNDLE_PATH`: Provide a file path to the CA bundle (recommended for large CA bundles to avoid "Argument list too long" errors)
+
+**Example using file path:**
+```yaml
+# docker-compose.yml or Kubernetes deployment
+environment:
+  PG_CA_BUNDLE_PATH: /etc/ssl/certs/ca-certificates.crt
+```
+
+**Note:** When using `PG_CA_BUNDLE_PATH`, the file is read during configuration generation, avoiding environment size limitations. This is the recommended approach when using system CA bundles or large certificate collections.
+
 ### Authentication Configuration
 
 #### `auth.disable-signup` (boolean)

entrypoint.sh

@@ -27,12 +27,12 @@ generate_saml_defaults() {
   fi
 }
 
-# Function to load CA bundle from file or environment variable
-load_pg_ca_bundle() {
+# Function to validate CA bundle path
+validate_pg_ca_bundle_path() {
   if [ -n "$PG_CA_BUNDLE_PATH" ]; then
     if [ -f "$PG_CA_BUNDLE_PATH" ]; then
       echo "Loading PostgreSQL CA bundle from: $PG_CA_BUNDLE_PATH"
-      export PG_CA_BUNDLE=$(cat "$PG_CA_BUNDLE_PATH")
+      export PG_CA_BUNDLE_FILE="$PG_CA_BUNDLE_PATH"
     else
       echo "Warning: PG_CA_BUNDLE_PATH specified but file not found: $PG_CA_BUNDLE_PATH"
     fi
@@ -48,8 +48,8 @@ else
   # Generate default SAML credentials if not provided
   generate_saml_defaults
 
-  # Load PostgreSQL CA bundle if configured
-  load_pg_ca_bundle
+  # Validate PostgreSQL CA bundle path if configured
+  validate_pg_ca_bundle_path
 
   # Create directory if it doesn't exist
   mkdir -p "$(dirname "$CONFIG_FILE")"
@@ -85,7 +85,12 @@ probod:
 EOF
 
   # Add PostgreSQL CA bundle if configured
-  if [ -n "$PG_CA_BUNDLE" ]; then
+  if [ -n "$PG_CA_BUNDLE_FILE" ]; then
+    cat >> "$CONFIG_FILE" <<EOF
+    ca-bundle: |
+$(cat "$PG_CA_BUNDLE_FILE" | sed 's/^/      /')
+EOF
+  elif [ -n "$PG_CA_BUNDLE" ]; then
     cat >> "$CONFIG_FILE" <<EOF
     ca-bundle: |
 $(echo "$PG_CA_BUNDLE" | sed 's/^/      /')