Support configuring the trusted certificate bundle for Mountpoint

[dannycjones]

Tell us more about this new feature.

Many AWS clients support configuring the trusted certificate bundle through the environment variable AWS_CA_BUNDLE, allowing for Mountpoint to use a CA bundle different from the one configured by the operating system. This is documented here: https://docs.aws.amazon.com/sdkref/latest/guide/feature-gen-config.html

This can be useful for testing, the use of proxies, etc..

There is an open feature request for this functionality on the CSI driver repo: awslabs/mountpoint-s3-csi-driver#514. Note, that it is not possible at this time to configure the environment for the Mountpoint pod used by CSI Driver V2 - so simply adding AWS_CA_BUNDLE support to Mountpoint would not be enough.

[dannycjones]

This feature isn't something we're working on at this time. That being said, I'll note two approaches that could be followed if this were to be worked on.

Either:

• Writing new Rust-to-C bindings to AWS CRT, allowing the client to be configured with aws_tls_ctx_options as explored in Including the cluster CA root in the mountpoint pod's trust store. mountpoint-s3-csi-driver#514. Mountpoint could expose this via AWS_CA_BUNDLE.
• Request awslabs/aws-c-s3 to support AWS_CA_BUNDLE.

The first option is most flexible, and would leave Mountpoint code in control of how this is implemented. Note that neither the AWS CRT nor the AWS Rust SDK (which we may one day want to switch to) currently appear to support AWS_CA_BUNDLE but instead offer ways to configure it in code.