[bitnami/keycloak] Add custom certs to system truststore

[moritzwiechers]

to enable https-communication with hosts with certificates generated by custom ca's.

Description of the change

Added the option to specify a secret which contains the custom ca certificates. They will be mounted to the container and loaded on keycloak startup by setting the environment variable KC_TRUSTSTORE_PATHS

Benefits

• Easy way to add custom-ca's to keycloak to communicate with onprem ldap/identity provider etc.
• No need to configure keystores/truststore, add keys or other things related to the tls settings

Applicable issues

Should resolve:

• Set an additional CA in keycloak's trust bundle #6602
• keycloak add cacert value or better documentation using existing values #7536
• [bitnami/keycloak] Better documentation on how to add certificate for ldaps #7796
• Keycloak and LDAPS User Federation #10829

Checklist

• Chart version bumped in Chart.yaml according to semver. This is not necessary when the changes only affect README.md files.
• Variables are documented in the values.yaml and added to the README.md using readme-generator-for-helm
• Title of the pull request follows this pattern [bitnami/<name_of_the_chart>] Descriptive title
• All commits signed off and in agreement of Developer Certificate of Origin (DCO)

[migruiz4]

Hi @moritzwiechers,

Thank you for your contribution! Since this is a new feature, could you please bump a minor version?

[migruiz4]

Could you please update the value description? I left a suggestion below:

[migruiz4]

Suggested change

	## @param customCaExistingSecret define a secret for merging certificates to the system trustore like custom ca-certs (pem, pkcs12)
	## @param customCaExistingSecret Name of the secret containing the Keycloak custom CA certificates. The secret will be mounted as a directory and configured using KC_TRUSTSTORE_PATHS.

[moritzwiechers]

Thanks for your review.
Updated the value description. Put it in one commit with readme update version bump

[moritzwiechers]

@migruiz4 Is there anything you need from me to advance with your review?

[migruiz4]

Looks good to me!

[luhahn]

thats basically what were currently trying to do, does it work for you this way? It still seems ldaps ignores our certificates.

[moritzwiechers]

thats basically what were currently trying to do, does it work for you this way? It still seems ldaps ignores our certificates.

Hey,
It should work for ldap, the docs name it outgoing ssl connections. I tested it with an ms adfs configured as oidc identity Provider. Maybe you could show your config. And the start up log from your keycloak container.
Also please make sure, that the server you a trying to connect sends the correct cert including the whole certificate chain. (especially when you use intermediate ca's explanation

[chee-yee]

Hi, please can someone share an example of the required configuration in the YAML file for adding a certificate which has been created as a secret named "keycloak-ldaps-cert"?

I've added the below but still LDAPS is not able to connect - do I need to specify additional config in order for the certificate to be referenced by KeyCloak?

customCaExistingSecret: keycloak-ldaps-cert

cc: @moritzwiechers

[moritzwiechers]

hey,
adding
customCaExistingSecret: keycloak-ldaps-cert

is the right way. You need to create the secret before and it has to be in the same namespace, e.g.:

kubectl --namespace create secret generic keycloak-ldaps-cert --from-file=<path/to/your/.keycloak-ldaps-cert.pem>

Maybe you should check your keycloak log for any errors. When successfully loaded a message like this should appear on startup:

keycloak 2024-08-15 13:09:47,763 INFO [org.keycloak.truststore.TruststoreBuilder] (main) Found the following truststore files under directories specified in the truststore paths [/opt/bitnami/keycloak/custom-ca/keycloak-ldaps-cert.pem, /opt/bitnami/keycloak/custom-ca/..data/keycloak-ldaps-cert.pem, /opt/bitnami/keycloak/custom-ca/..2024_08_15_13_08_42.3315499878/keycloak-ldaps-cert.pem

[chee-yee]

Thanks for responding @moritzwiechers and will give it a try. Do you know if we need to specify any other parameters in the yaml file for KeyCloak to reference this certificate during LDAPS connection or is this the only config required?

[luhahn]

i couldn't get it to work with ldaps and simple certificates, so i ended up creating a java truststore and loaded it with

extraEnvVars:
  - name: JAVA_OPTS
    value: "-Djavax.net.ssl.trustStore=/opt/keycloak/truststores/truststore.jks -Djavax.net.ssl.trustStorePassword=changeme"

extraVolumes:
  - name: ca-secret
    secret:
      secretName: certificates-secret
      defaultMode: 420
      items:
        - key: truststore.jks
          path: truststore.jks

extraVolumeMounts:
  - name: ca-secret
    mountPath: /opt/keycloak/truststores
    readOnly: true