feat: 支持通过configmap挂载证书并解密

deployment/helm/datamate/values.yaml

@@ -40,6 +40,7 @@ public:
   secrets:
     data:
       DB_PASSWORD: "password"
+      CERT_PASS: ""
 
 datasetVolume: &datasetVolume
   name: dataset-volume
@@ -136,7 +137,7 @@ backend-python:
 gateway:
   env:
     - name: JWT_SECRET
-      value: &JWT_SECRET "default-insecure-key-change-in-production"
+      value: "default-insecure-key-change-in-production"
   volumes:
     - *logVolume
   volumeMounts:
@@ -148,12 +149,24 @@ frontend:
   service:
     type: NodePort
     nodePort: 30000
+  env:
+    - name: CERT_PASS
+      valueFrom:
+        secretKeyRef:
+          name: datamate-conf
+          key: CERT_PASS
   volumes:
     - *logVolume
+    - name: cert-volume
+      configMap:
+        name: cube-security-cert-cert
+        optional: true
   volumeMounts:
     - name: log-volume
       mountPath: /var/log/datamate/frontend
       subPath: frontend
+    - name: cert-volume
+      mountPath: /cert
 
 runtime:
   enabled: false

scripts/images/frontend/https_backend.conf

@@ -7,7 +7,7 @@ server {
 
     client_max_body_size 1024M;
 
-    ssl_certificate     /etc/nginx/cert/server.crt;
+    ssl_certificate     /etc/nginx/cert/server.pem;
     ssl_certificate_key /etc/nginx/cert/server.key;
 
     error_page 497 https://$host$request_uri;

scripts/images/frontend/start.sh

@@ -1,8 +1,20 @@
 #!/bin/bash
 
-set -e
+if [ -f "/cert/server.pem" ]; then
+    cp /cert/server.pem /etc/nginx/cert/server.pem
+    chown nginx:nginx /etc/nginx/cert/server.pem
+fi
+
+if [ -f "/cert/server.key" ]; then
+  if openssl rsa -in /cert/server.key -passin pass:test_check -noout 2>/dev/null; then
+    cp /cert/server.key /etc/nginx/cert/server.key
+  else
+    echo "$CERT_PASS" | openssl rsa -in /cert/server.key -out /etc/nginx/cert/server.key -passin stdin
+  fi
+  chown nginx:nginx /etc/nginx/cert/server.key
+fi
 
-if [ -f "/etc/nginx/cert/ca.crt" ]; then
+if [ -f "/etc/nginx/cert/server.pem" ]; then
     cp /opt/frontend/https_backend.conf /etc/nginx/conf.d/default.conf
     cp /opt/frontend/routes.inc /etc/nginx/conf.d/routes.inc
     echo "Switching to HTTPS config"