tls: add client identity configuration for mTLS

[philgebhardt]

Background

An upcoming release of Gremlin and Chao will support configuring a client identity for TLS, facilitating mutual TLS (mTLS)

Change

• Expose chao.tls.identity and gremlin.tls.identity objects for configuring a client identity certificate and private key
• When enabled, add generation for chao and gremlin secrets to hold certificate and private key data

Test

• unit tests for remoteSecret
• unit tests for createSecret
• unit tests for existingSecret
• unit tests for multiple configurations

[Copilot]

Pull request overview

This PR adds Helm chart support for configuring a TLS client identity (certificate + private key) to enable mutual TLS (mTLS) for Gremlin (daemonset and integrations) and Chao (deployment), including optional secret generation and wiring into runtime configuration.

Changes:

• Adds *.tls.identity values for Gremlin, Chao, and Gremlin Integrations with remoteSecret, createSecret, and existingSecret strategies.
• Adds new Secret templates for the createSecret strategy (Gremlin + Chao + Integrations) and mounts/args/env wiring to consume identity material.
• Adds/extends helm-unittest coverage for identity strategies, and bumps chart versions / minimum app version.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 14 comments.

Show a summary per file

File	Description
gremlin/values.yaml	Documents and introduces gremlin.tls.identity + chao.tls.identity configuration schema.
gremlin/tests/secret_gremlin_tls_identity_test.yaml	New unit tests for Gremlin TLS identity Secret rendering behavior.
gremlin/tests/secret_chao_tls_identity_test.yaml	New unit tests for Chao TLS identity Secret rendering behavior.
gremlin/tests/daemonset_test.yaml	Extends daemonset tests to validate env/volume behavior for identity strategies.
gremlin/tests/chao_deployment_test.yaml	Extends chao deployment tests to validate args/volume behavior for identity strategies.
gremlin/templates/secret-gremlin-tls-identity.yaml	New Secret template for Gremlin createSecret identity material.
gremlin/templates/secret-chao-tls-identity.yaml	New Secret template for Chao createSecret identity material.
gremlin/templates/daemonset.yaml	Wires Gremlin identity env + mounts + volumes into the daemonset.
gremlin/templates/chao-deployment.yaml	Wires Chao identity args + mounts + volumes into the deployment.
gremlin/templates/_helpers.tpl	Adds validation + helper renderers for Gremlin and Chao identity strategies.
gremlin/Chart.yaml	Bumps chart version and minimum supported app version.
gremlin-integrations/values.yaml	Adds gremlin.tls.identity schema for the integrations chart.
gremlin-integrations/tests/secret_gremlin_tls_identity_test.yaml	New unit tests for Integrations TLS identity Secret rendering behavior.
gremlin-integrations/tests/deployment_tls_test.yaml	New unit tests for Integrations deployment identity env/volume behavior.
gremlin-integrations/templates/secret-gremlin-tls-identity.yaml	New Secret template for Integrations createSecret identity material.
gremlin-integrations/templates/deployment.yaml	Wires identity env + mounts + volumes into the integrations deployment.
gremlin-integrations/templates/_helpers.tpl	Adds validation + helper renderers for integrations identity strategies.
gremlin-integrations/Chart.yaml	Bumps integrations chart and app versions.

Comments suppressed due to low confidence (1)

gremlin/templates/chao-deployment.yaml:136

• volumeMounts: is only emitted when the Gremlin cert or ssl.certFile conditions are true. If chao.tls.identity is enabled without those other mounts, the TLS identity volumeMount list items will render without a volumeMounts: key, producing invalid YAML. Consider expanding the condition that emits volumeMounts: to also cover TLS identity mounts.

{{- if (or ((eq (include "gremlin.secretType" .) "certificate")) .Values.ssl.certFile) }}
          volumeMounts:
{{- end }}
{{- if (eq (include "gremlin.secretType" .) "certificate") }}
          - name: gremlin-cert

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.