feat(helm): support custom CA certificates

charts/platform/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to this chart will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.39.0] - 2026-07-27
+
+### Added
+
+- `global.trustStore` for distributing a private/internal CA to Platform and its subcharts.
+  Enable it when components must reach endpoints whose certificates are signed by a CA that is
+  in no public trust store — an intranet-only deployment behind an enterprise PKI, or a
+  corporate firewall performing HTTPS interception. Off by default.
+  - Supply the CA inline with `global.trustStore.certificate` (the chart creates the
+    ConfigMap), or reference one you manage with `existingConfigMap` or `existingSecret`.
+  - JVM components (`backend`, `cron`, `wave`, and cron's `migrate-db` init container) get a
+    Java trust store built by a `build-trust-store` init container and are pointed at it with
+    `JAVA_TOOL_OPTIONS`. The store is seeded from the JRE's existing bundle, so public trust is
+    preserved. Note that the JVM logs `Picked up JAVA_TOOL_OPTIONS: ...` to stderr at startup.
+  - Python/Go/OpenSSL subcharts (`agent-backend`, `mcp`, `pipeline-optimization`) get a generated
+    system-plus-private PEM bundle selected with `SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE`, and
+    `CURL_CA_BUNDLE`. `portal-web` uses Node.js's additive `NODE_EXTRA_CA_CERTS`.
+  - The init container runs each component's own image by default, so every component's trust
+    store is seeded from its own JDK. Override with `global.trustStore.java.image` only when a
+    component image does not ship `keytool`, and match the vendor and major JDK version.
+  - This is separate from database TLS, which is still configured through the driver's own
+    option (`platformDatabase.connectionOptions.mariadb` `serverSslCert`, or a subchart's
+    `database.sslCa`). Those cover the database connection only and do nothing for any other
+    outbound call. Point them at `global.trustStore.mountPath` when the database certificate is
+    signed by the same CA.
+  - Does not cover the BuildKit pods Wave launches for builds. Those run outside this chart and
+    need a BuildKit image with the CA in its system bundle, selected with
+    `wave.build.buildkit-image`.
+
+### Changed
+
+- Bumped the `seqera-common` library dependency to `3.1.0`.
+
 ## [0.38.0] - 2026-07-24
 
 ### Changed

charts/platform/Chart.lock

@@ -4,24 +4,24 @@ dependencies:
   version: 2.41.0
 - name: seqera-common
   repository: file://../seqera-common
-  version: 3.0.0
+  version: 3.1.0
 - name: pipeline-optimization
   repository: file://charts/pipeline-optimization
-  version: 2.2.1
+  version: 2.3.0
 - name: studios
   repository: file://charts/studios
-  version: 1.7.0
+  version: 1.7.1
 - name: wave
   repository: file://charts/wave
-  version: 0.5.1
+  version: 0.6.0
 - name: mcp
   repository: file://charts/mcp
-  version: 0.7.0
+  version: 0.8.0
 - name: agent-backend
   repository: file://charts/agent-backend
-  version: 1.4.0
+  version: 1.5.0
 - name: portal-web
   repository: file://charts/portal-web
-  version: 0.6.0
-digest: sha256:9d7c8c2eb65f6ddb8d60e1dfe32af5866e1841ca3300217fd29d53def185494f
-generated: "2026-07-24T13:09:53.869391834+02:00"
+  version: 0.7.0
+digest: sha256:a73bec71b7c0783f0294422b28947d695a83bcccb7ae02008aad2427e06044e6
+generated: "2026-07-27T17:13:50.563751+01:00"

charts/platform/Chart.yaml

@@ -38,7 +38,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.38.0
+version: 0.39.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -81,13 +81,13 @@ dependencies:
       - studios
     condition: studios.enabled
   - name: wave
-    version: "0.5.x"
+    version: "0.6.x"
     repository: "file://charts/wave"
     tags:
       - wave
     condition: wave.enabled
   - name: mcp
-    version: "0.7.x"
+    version: "0.8.x"
     repository: "file://charts/mcp"
     tags:
       - mcp
@@ -99,7 +99,7 @@ dependencies:
       - agent-backend
     condition: agent-backend.enabled
   - name: portal-web
-    version: "0.6.x"
+    version: "0.7.x"
     repository: "file://charts/portal-web"
     tags:
       - portal-web

charts/platform/README.md

@@ -2,7 +2,7 @@
 
 A Helm chart to deploy Seqera Platform (also referred to as Tower) on Kubernetes.
 
-![Version: 0.38.0](https://img.shields.io/badge/Version-0.38.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v26.1.4](https://img.shields.io/badge/AppVersion-v26.1.4-informational?style=flat-square)
+![Version: 0.39.0](https://img.shields.io/badge/Version-0.39.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v26.1.4](https://img.shields.io/badge/AppVersion-v26.1.4-informational?style=flat-square)
 
 Some basic familiarity with Helm is assumed. If you are new to Helm, please refer to the [Helm documentation](https://helm.sh/docs/).
 We recommend reading through the `values.yaml` file to understand the configuration options available for the chart. Each entry is documented with `# --` comments describing its purpose and usage. Other annotations are used to automatically generate the README files and can be ignored:
@@ -48,13 +48,13 @@ To install the chart:
 
 1. Download the default values file:
    ```console
-   helm show values oci://public.cr.seqera.io/charts/platform --version 0.38.0 > values.yaml
+   helm show values oci://public.cr.seqera.io/charts/platform --version 0.39.0 > values.yaml
    ```
 2. Edit `values.yaml` to match your environment. We recommend removing entries whose defaults you don't need to override — this keeps your configuration file focused and easier to maintain across upgrades.
 3. Install the chart with the release name `my-release`:
    ```console
    helm install my-release oci://public.cr.seqera.io/charts/platform \
-     --version 0.38.0 \
+     --version 0.39.0 \
      --namespace my-namespace \
      --create-namespace \
      -f values.yaml
@@ -70,7 +70,7 @@ Charts are also published to a traditional Helm repository. This can be useful i
 helm repo add seqeralabs https://seqeralabs.github.io/helm-charts
 helm repo update
 helm install my-release seqeralabs/platform \
-  --version 0.38.0 \
+  --version 0.39.0 \
   --namespace my-namespace \
   --create-namespace \
   -f values.yaml
@@ -92,11 +92,11 @@ When upgrading between versions, please refer to the [CHANGELOG.md](CHANGELOG.md
 |------------|------|---------|
 | file://../seqera-common | seqera-common | 3.x.x |
 | file://charts/agent-backend | agent-backend | 1.x.x |
-| file://charts/mcp | mcp | 0.7.x |
+| file://charts/mcp | mcp | 0.8.x |
 | file://charts/pipeline-optimization | pipeline-optimization | 2.x.x |
-| file://charts/portal-web | portal-web | 0.6.x |
+| file://charts/portal-web | portal-web | 0.7.x |
 | file://charts/studios | studios | 1.x.x |
-| file://charts/wave | wave | 0.5.x |
+| file://charts/wave | wave | 0.6.x |
 | oci://registry-1.docker.io/bitnamicharts | common | 2.x.x |
 
 ## Values
@@ -116,6 +116,29 @@ When upgrading between versions, please refer to the [CHANGELOG.md](CHANGELOG.md
 | global.agentBackendDomain | string | `"{{ printf \"ai-api.%s\" .Values.global.platformExternalDomain }}"` | Domain where the Agent Backend service listens. Evaluated as a template |
 | global.portalWebDomain | string | `"{{ printf \"ai.%s\" .Values.global.platformExternalDomain }}"` | Domain where the Portal Web frontend listens. Evaluated as a template |
 
+### Global: Trust Store
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| global.trustStore.enabled | bool | `false` | Enable private CA trust distribution. Requires one of `certificate`, `existingConfigMap`, or `existingSecret` |
+| global.trustStore.certificate | string | `""` | Inline PEM CA bundle. When set, the chart creates a ConfigMap holding it. Use `existingConfigMap` or `existingSecret` instead to manage the bundle outside the release |
+| global.trustStore.existingConfigMap | string | `""` | Name of an existing ConfigMap holding the CA bundle. Evaluated as a template |
+| global.trustStore.existingSecret | string | `""` | Name of an existing Secret holding the CA bundle. Takes precedence over `existingConfigMap`. Evaluated as a template |
+| global.trustStore.key | string | `"ca.crt"` | Key within the ConfigMap or Secret that holds the PEM bundle |
+| global.trustStore.mountPath | string | `"/opt/seqera/trust"` | Directory the PEM bundle is mounted into |
+| global.trustStore.javaMountPath | string | `"/opt/seqera/truststore"` | Directory generated trust assets are written to (a Java trust store or combined PEM bundle). Must be writable, so it is backed by an `emptyDir` — the containers run with a read-only root filesystem |
+| global.trustStore.java.image.registry | string | `""` | Override the trust store init container image registry. Only used when `repository` is set |
+| global.trustStore.java.image.repository | string | `""` | Override the trust store init container image repository. Leave empty to run each component's own image, which is the recommended default. Set this only when a component image does not ship `keytool` — then match the vendor and major JDK version of the component to avoid substituting a different set of public roots |
+| global.trustStore.java.image.tag | string | `""` | Trust store init container image tag. Only used when `repository` is set |
+| global.trustStore.java.image.digest | string | `""` | Trust store init container image digest in the format `sha256:1234abcdef`. Only used when `repository` is set |
+| global.trustStore.java.image.pullPolicy | string | `"IfNotPresent"` | imagePullPolicy for the trust store init container |
+| global.trustStore.java.password | string | `"changeit"` | Password protecting the generated trust store. This guards the store's integrity, not its confidentiality, and `changeit` is the JRE default carried over from the seeded bundle. Changing it requires no other configuration |
+| global.trustStore.java.securityContext.runAsUser | int | `101` | UID the container processes run as (overrides container image default) |
+| global.trustStore.java.securityContext.runAsNonRoot | bool | `true` | Require the container to run as a non-root UID (prevents starting if UID 0) |
+| global.trustStore.java.securityContext.readOnlyRootFilesystem | bool | `true` | Mount the container root filesystem read-only to prevent in-place writes or tampering |
+| global.trustStore.java.securityContext.capabilities | object | `{"drop":["ALL"]}` | Fine-grained Linux kernel privileges to add or drop for the container |
+| global.trustStore.java.resources | object | `{"limits":{"memory":"256Mi"},"requests":{"cpu":"0.25","memory":"128Mi"}}` | Container requests and limits for different resources like CPU or memory |
+
 ### Global: Ingress
 
 | Key | Type | Default | Description |

charts/platform/charts/agent-backend/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this chart will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.5.0] - 2026-07-27
+
+### Added
+
+- Support for `global.trustStore`, preserving the image's public CA roots while adding a
+  private/internal CA for outbound TLS connections.
+
 ## [1.4.0] - 2026-07-24
 
 ### Added

charts/platform/charts/agent-backend/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 2.41.0
 - name: seqera-common
   repository: file://../../../seqera-common
-  version: 3.0.0
-digest: sha256:e42fae8c59a4a9bdc582478c6f4a5955ea9ea9c985d0f9142f31c97196cf2642
-generated: "2026-07-10T16:58:34.042034796+02:00"
+  version: 3.1.0
+digest: sha256:a4b78ffdfeae607b2d5f4f07da5a8ad438100da87ce0a2073211509e6a1ac29f
+generated: "2026-07-27T16:35:14.046846+01:00"

charts/platform/charts/agent-backend/Chart.yaml

@@ -19,7 +19,7 @@ apiVersion: v2
 name: agent-backend
 description: Backend service for Seqera CLI AI capabilities
 type: application
-version: 1.4.0
+version: 1.5.0
 appVersion: "1.13.1"
 icon: https://raw.githubusercontent.com/seqeralabs/helm-charts/master/media/seqera-icon-light.svg
 maintainers:

charts/platform/charts/agent-backend/README.md

@@ -2,7 +2,7 @@
 
 Backend service for Seqera CLI AI capabilities
 
-![Version: 1.4.0](https://img.shields.io/badge/Version-1.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.13.1](https://img.shields.io/badge/AppVersion-1.13.1-informational?style=flat-square)
+![Version: 1.5.0](https://img.shields.io/badge/Version-1.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.13.1](https://img.shields.io/badge/AppVersion-1.13.1-informational?style=flat-square)
 
 Some basic familiarity with Helm is assumed. If you are new to Helm, please refer to the [Helm documentation](https://helm.sh/docs/).
 We recommend reading through the `values.yaml` file to understand the configuration options available for the chart. Each entry is documented with `# --` comments describing its purpose and usage. Other annotations are used to automatically generate the README files and can be ignored:
@@ -51,13 +51,13 @@ To install the chart:
 
 1. Download the default values file:
    ```console
-   helm show values oci://public.cr.seqera.io/charts/agent-backend --version 1.4.0 > values.yaml
+   helm show values oci://public.cr.seqera.io/charts/agent-backend --version 1.5.0 > values.yaml
    ```
 2. Edit `values.yaml` to match your environment. We recommend removing entries whose defaults you don't need to override — this keeps your configuration file focused and easier to maintain across upgrades.
 3. Install the chart with the release name `my-release`:
    ```console
    helm install my-release oci://public.cr.seqera.io/charts/agent-backend \
-     --version 1.4.0 \
+     --version 1.5.0 \
      --namespace my-namespace \
      --create-namespace \
      -f values.yaml
@@ -73,7 +73,7 @@ Charts are also published to a traditional Helm repository. This can be useful i
 helm repo add seqeralabs https://seqeralabs.github.io/helm-charts
 helm repo update
 helm install my-release seqeralabs/agent-backend \
-  --version 1.4.0 \
+  --version 1.5.0 \
   --namespace my-namespace \
   --create-namespace \
   -f values.yaml

charts/platform/charts/agent-backend/templates/deployment.yaml

@@ -63,6 +63,7 @@ spec:
 {{- end }}
 
       initContainers:
+{{- include "seqera.trustStore.initContainer" (dict "context" $ "imageRoot" .Values.image "java" false "pem" true) | nindent 8 }}
 {{- with .Values.initContainers }}
         {{- include "seqera.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
 {{- end }}
@@ -134,6 +135,7 @@ spec:
                   name: {{ include "agent-backend.redis.existingSecret.secretName" . }}
                   key: {{ include "agent-backend.redis.existingSecret.secretKey" . }}
 {{- end }}
+{{- include "seqera.trustStore.envVars" (dict "context" $ "java" false) | nindent 12 }}
 {{- with .Values.extraEnvVars }}
             {{- include "seqera.envVars.render" (dict "value" . "context" $) | nindent 12 }}
 {{- end }}
@@ -151,6 +153,7 @@ spec:
           volumeMounts:
             - name: tmp
               mountPath: /tmp
+{{- include "seqera.trustStore.volumeMounts" (dict "context" $ "java" false "pem" true) | nindent 12 }}
 {{- with .Values.extraVolumeMounts }}
             {{- include "seqera.tplvalues.render" (dict "value" . "context" $) | nindent 12 }}
 {{- end }}
@@ -173,6 +176,7 @@ spec:
       volumes:
         - name: tmp
           emptyDir: {}
+{{- include "seqera.trustStore.volumes" (dict "context" $ "java" false "pem" true) | nindent 8 }}
 {{- with .Values.extraVolumes }}
         {{- include "seqera.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
 {{- end }}

charts/platform/charts/mcp/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this chart will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.0] - 2026-07-27
+
+### Added
+
+- Support for `global.trustStore`, preserving the image's public CA roots while adding a
+  private/internal CA for outbound TLS connections.
+
 ## [0.7.0] - 2026-07-17
 
 ### Added

charts/platform/charts/mcp/Chart.lock

@@ -4,6 +4,6 @@ dependencies:
   version: 2.41.0
 - name: seqera-common
   repository: file://../../../seqera-common
-  version: 3.0.0
-digest: sha256:5fe6ff15ea4f83e51e9469a184f4a1a082d95eb63f78ebd6a700e3da5cbdac72
-generated: "2026-07-10T16:58:41.236062984+02:00"
+  version: 3.1.0
+digest: sha256:58d8a1914f755d09dec53e9f2ca4c41b4e957b4ddd1acdb6e6413ac52f75d2df
+generated: "2026-07-27T16:35:16.610577+01:00"

charts/platform/charts/mcp/Chart.yaml

@@ -22,7 +22,7 @@ description: |
   Wave container provisioning, bioinformatics data, and nf-core modules through intelligent
   RAG-based natural language interactions.
 type: application
-version: 0.7.0
+version: 0.8.0
 appVersion: "1.4.2"
 icon: https://raw.githubusercontent.com/seqeralabs/helm-charts/master/media/seqera-icon-light.svg
 maintainers:

charts/platform/charts/mcp/README.md

@@ -4,7 +4,7 @@ A Model Context Protocol (MCP) server that provides comprehensive access to the
 Wave container provisioning, bioinformatics data, and nf-core modules through intelligent
 RAG-based natural language interactions.
 
-![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.4.2](https://img.shields.io/badge/AppVersion-1.4.2-informational?style=flat-square)
+![Version: 0.8.0](https://img.shields.io/badge/Version-0.8.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.4.2](https://img.shields.io/badge/AppVersion-1.4.2-informational?style=flat-square)
 
 Some basic familiarity with Helm is assumed. If you are new to Helm, please refer to the [Helm documentation](https://helm.sh/docs/).
 We recommend reading through the `values.yaml` file to understand the configuration options available for the chart. Each entry is documented with `# --` comments describing its purpose and usage. Other annotations are used to automatically generate the README files and can be ignored:
@@ -45,13 +45,13 @@ To install the chart:
 
 1. Download the default values file:
    ```console
-   helm show values oci://public.cr.seqera.io/charts/mcp --version 0.7.0 > values.yaml
+   helm show values oci://public.cr.seqera.io/charts/mcp --version 0.8.0 > values.yaml
    ```
 2. Edit `values.yaml` to match your environment. We recommend removing entries whose defaults you don't need to override — this keeps your configuration file focused and easier to maintain across upgrades.
 3. Install the chart with the release name `my-release`:
    ```console
    helm install my-release oci://public.cr.seqera.io/charts/mcp \
-     --version 0.7.0 \
+     --version 0.8.0 \
      --namespace my-namespace \
      --create-namespace \
      -f values.yaml
@@ -67,7 +67,7 @@ Charts are also published to a traditional Helm repository. This can be useful i
 helm repo add seqeralabs https://seqeralabs.github.io/helm-charts
 helm repo update
 helm install my-release seqeralabs/mcp \
-  --version 0.7.0 \
+  --version 0.8.0 \
   --namespace my-namespace \
   --create-namespace \
   -f values.yaml