Use custom certificates with executors

By default, executors will search for certificates in the following files and directories:

If your environment makes use of custom certificates, you can add them to one of these locations in order for executors to pick them up.

Add certificates to a binary deployment

NOTE: see the troubleshooting guide for instructions on how to connect to cloud provider VMs.

After successfully deploying binaries, follow these steps:

1. Copy your certificates to /etc/ssl/certs.
2. If you are using systemd, run systemctl restart executor. If not, proceed to the next step.
3. Run executor run on the VM in order to restart the executor service.

Add certificates with Firecracker

When running executors with the firecracker runtime, custom certificates need to be added in the container that is running within the Firecracker VM. To add custom certificates, you must create a new Docker image that contains the certificates. For example,

DOCKERFILE
FROM upstream:tag
 
# Copy the certificates into the container
COPY customcert.crt /usr/local/share/ca-certificates/customcert.crt
# Update the certificate store
RUN chmod 644 /usr/local/share/ca-certificates/customcert.crt && update-ca-certificates
# ...

Code navigation

Once the custom image is built, you can configure the executor to use it by setting the codeIntelAutoIndexing.indexerMap to use the custom image. For example,

JSON
"codeIntelAutoIndexing.indexerMap": {
  "go": "myregistry.company.com/scip-go:custom"
}

Add certificates to a Kubernetes deployment using manifests

First, add the certificate data as a secret in your preferred namespace:

SHELL
SECRET_NAME=custom-certs
CERT_PATH=/path/to/cert.pem
kubectl create secret generic $SECRET_NAME --from-file=customcert.crt=$CERT_PATH

Or as a declarative manifest:

YAML
apiVersion: v1
kind: Secret
metadata:
    name: custom-certs
data:
    customcert.crt: $(base64 -i /path/to/cert.pem)
type: Opaque

Next, mount the secret in the executor deployment. Add the following snippet to spec.template.spec.volumes of each executor deployment:

YAML
- name: custom-certs
  secret:
      secretName: custom-certs

Also add this snippet to spec.template.spec.containers.volumeMounts of each executor deployment (specifically, the executor container, in case you inject any sidecars):

YAML
- mountPath: /etc/ssl/certs
  name: custom-certs
  readOnly: true

Next, apply the updated YAML manifests. Once the executors have rolled out, they should be picking up your custom certificates.

Add certificates to a Kubernetes deployment using Helm

You may follow the same instructions for the manifest deployment to set custom certificates.

Add certificates to a Docker Compose deployment

First, ensure that the certificate file is present on the host machine. Next, add the volume to the executor compose file:

YAML
- '/path/to/certs:/etc/ssl/certs'

Next, restart the deployment with docker-compose down and docker-compose up -d.