helm: Support reloading TLS certs about k8s

[rolandjitsu]

@wallyqs does this mean that as of today, if we update the TLS certs, NATS won't pick up on those changes?

[sdkim81]

@wallyqs does this mean that as of today, if we update the TLS certs, NATS won't pick up on those changes?

AFAIK, any changes in secret resource isn't applied into a deployed POD unlike a "configmap".
i.e) If there is any change in configmap, it's applied into a deployed POD and reloader container will catch this changes but any changes for secret resource, it isn't applied into POD. So reloader can't catch this configuration changes.

I guess it's very helpful for zero downtime on updating a TLS cert.

@wallyqs
Could you share a plan to backport this feature as you mentioned?

[wallyqs]

That's right, to fix this need to mount the secrets that could change into the container from the reloader here: https://github.com/nats-io/k8s/blob/main/helm/charts/nats/templates/statefulset.yaml#L456-L462
Then pass the --config flag for each one of the secrets that need to be monitored for changes to reload the server.

[sdkim81]

That's right, to fix this need to mount the secrets that could change into the container from the reloader here: https://github.com/nats-io/k8s/blob/main/helm/charts/nats/templates/statefulset.yaml#L456-L462 Then pass the --config flag for each one of the secrets that need to be monitored for changes to reload the server.

Thanks. It works well 👍