[achoimet]

Part of Extensions support self-signed certificates. Same pattern as steadybit/extension-grafana#114.

Uses exttls from extension-kit v1.12.2 (steadybit/extension-kit#193).

Adds the two options every extension talking to a self-hostable service should offer:

• Mount your own CA: the chart now supports extraVolumes / extraVolumeMounts, so the CA can be mounted and added to SSL_CERT_DIR via extraEnv.
• Skip verification: new stackstate.insecureSkipVerify value → STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY.

The StackState resty client uses exttls.Transport(); it is the only outbound client. README section "Importing your own certificates", chart version bumped to 1.1.41.

Tests

• Helm unittest: new snapshot with custom certificates + insecureSkipVerify (24/24 pass).

• Unit tests pass.

• New e2e TestWithMinikubeSelfSignedCertificate: the mock StackState is served over HTTPS with a self-signed certificate for host.minikube.internal, one cluster per scenario:

  • default → nothing discovered, and the mock records TLS handshake errors (proves the certificate was rejected, not that the mock was unreachable)
  • stackstate.insecureSkipVerify=true → services discovered
  • CA mounted from a ConfigMap + SSL_CERT_DIR → services discovered

  All three pass locally (276s).

[claude]

Claude finished @achoimet's task in 11s —— View job

---

Review of PR #162

• Checked for earlier unresolved review threads from me. None were raised, so there was nothing to resolve.
• Reviewed the chart, main.go and e2e changes.

No blocking issues found.

• exttls.Transport() is applied to the only outbound client (the resty client in main.go), so TLS handling covers all of the extension's traffic.
• STEADYBIT_EXTENSION_INSECURE_SKIP_VERIFY is always rendered, as "false" by default. It is quoted correctly, so there is no YAML boolean-typing problem.
• extraVolumes and extraVolumeMounts are appended after the library-provided ones, and the with guards keep the output clean when they are empty.
• The e2e mock counts TLS handshake errors and resets the count per scenario. That makes the "rejected by default" case a real check, because it separates a rejected certificate from an unreachable server.
• I did not run the tests myself. The e2e test needs minikube.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud