XRAY: How to mount Certificates to Xray using Helm

The simplest way to mount certificates to Xray is to use a secret with the certificate data and mount it using the customCertificates in the values.yaml file. This will enable TLS communication between Xray and other software such as Artifactory or PostgreSQL.

The customCertificates value, makes sure that the secret content will be copied to the $JFROG_HOME/xray/var/etc/security/keys/trusted directory. So we don’t have to worry about specifying the mount path.

We can start by creating the secret (Named xray-crt), which contains the certificate:

kubectl create secret generic xray-crt -n namespace --from-file=”./ca.crt”

Then, pass the secret name under customCertificates, and enable TLS for Xray router:

xray:
  router:
    tlsEnabled: true
  customCertificates:
    enabled: true
    certificateSecretName: xray-crt

Additionally, you may use customVolumeMounts, but that takes extra steps and should be used when you want to mount something that isn’t related to certificates that need to be in the trusted directory.