From 6855db88b8e2259e66a5d68606e70e1bbb817a42 Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Thu, 5 Nov 2026 11:39:25 +0500
Subject: [PATCH] =?UTF-8?q?uralkal:=20camunda=20keycloak=20=E2=80=94=20?=
 =?UTF-8?q?=D0=B4=D0=BE=D0=B2=D0=B5=D1=80=D0=B8=D0=B5=20=D0=BA=D0=BE=D1=80?=
 =?UTF-8?q?=D0=BD=D0=B5=D0=B2=D0=BE=D0=BC=D1=83=20CA=20BER-CA1=20=D0=B4?=
 =?UTF-8?q?=D0=BB=D1=8F=20LDAPS=20=D0=BA=20AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ConfigMap uralkali-ca с PEM BER-CA1 монтируется в /opt/uralkali-ca,
KC_TRUSTSTORE_PATHS=/opt/uralkali-ca/ber-ca1.crt добавляет его в Truststore SPI
Keycloak 25 поверх системных корней, без пересборки образа.
---
 infrastructure/camunda/uralkal/camunda.yaml   |  9 ++++++
 .../camunda/uralkal/kustomization.yaml        |  1 +
 .../camunda/uralkal/uralkali-ca.yaml          | 29 +++++++++++++++++++
 3 files changed, 39 insertions(+)
 create mode 100644 infrastructure/camunda/uralkal/uralkali-ca.yaml

diff --git a/infrastructure/camunda/uralkal/camunda.yaml b/infrastructure/camunda/uralkal/camunda.yaml
index a821642..68cdcf3 100644
--- a/infrastructure/camunda/uralkal/camunda.yaml
+++ b/infrastructure/camunda/uralkal/camunda.yaml
@@ -221,7 +221,16 @@ spec:
         - name: krb5
           configMap:
             name: keycloak-krb5
+        - name: uralkali-ca
+          configMap:
+            name: uralkali-ca
+      extraEnvVars:
+        - name: KC_TRUSTSTORE_PATHS
+          value: /opt/uralkali-ca/ber-ca1.crt
       extraVolumeMounts:
+        - name: uralkali-ca
+          mountPath: /opt/uralkali-ca
+          readOnly: true
         - name: keytab
           mountPath: /opt/keytab
           readOnly: true
diff --git a/infrastructure/camunda/uralkal/kustomization.yaml b/infrastructure/camunda/uralkal/kustomization.yaml
index 6755742..82011d2 100644
--- a/infrastructure/camunda/uralkal/kustomization.yaml
+++ b/infrastructure/camunda/uralkal/kustomization.yaml
@@ -3,5 +3,6 @@ kind: Kustomization
 resources:
   - ../base
   - keycloak-krb5.yaml
+  - uralkali-ca.yaml
 patches:
   - path: camunda.yaml
diff --git a/infrastructure/camunda/uralkal/uralkali-ca.yaml b/infrastructure/camunda/uralkal/uralkali-ca.yaml
new file mode 100644
index 0000000..578289a
--- /dev/null
+++ b/infrastructure/camunda/uralkal/uralkali-ca.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uralkali-ca
+  namespace: camunda
+data:
+  ber-ca1.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDsjCCApqgAwIBAgIQAXfxtRjCJrpJcAhO6t1LBzANBgkqhkiG9w0BAQsFADBY
+    MRMwEQYKCZImiZPyLGQBGRYDY29tMRgwFgYKCZImiZPyLGQBGRYIdXJhbGthbGkx
+    FTATBgoJkiaJk/IsZAEZFgVsb2NhbDEQMA4GA1UEAxMHQkVSLUNBMTAeFw0yMDAz
+    MjMwNTI3MzBaFw0yODAzMjMwNTM3MjlaMFgxEzARBgoJkiaJk/IsZAEZFgNjb20x
+    GDAWBgoJkiaJk/IsZAEZFgh1cmFsa2FsaTEVMBMGCgmSJomT8ixkARkWBWxvY2Fs
+    MRAwDgYDVQQDEwdCRVItQ0ExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+    AQEAnVGFDQfYgVNIsQv6uBVKKAudUwnmVq2781uCpDXPuVet84DfjAmYNcNgz45I
+    qikJPnkqcAtZimkQ8znmb7If2aQs1qPZ/7pSVhJU4Revode8jy2vpYPBXpbIw4pc
+    2Z8xWSP88hDWkkVcwze8GoFuVxKtikVaj4HCkWYikGpdKDko6f1sCj+K89kPEK11
+    l/0ij754c6cC5cyGy0XV5CqVpqZcef+aGu3P+835Skii2s+2j/EmmW9uiHQ7y6fl
+    OBqbn6tA8ofplhCDcfNSW76w1R2b+eH8X2RzJpIYKaVn/dQ6hdFjGzJAeSA4kzYl
+    XVv7rq2rEc7Bj1L1GgGCWh4puwIDAQABo3gwdjALBgNVHQ8EBAMCAYYwDwYDVR0T
+    AQH/BAUwAwEB/zAdBgNVHQ4EFgQUQ+2UXR7y3Q+vUIQBeS6uWsg0ogMwEgYJKwYB
+    BAGCNxUBBAUCAwMAAzAjBgkrBgEEAYI3FQIEFgQUd+FmCvlBWdlBdBK1bcGgDzrK
+    EUcwDQYJKoZIhvcNAQELBQADggEBAFxO66L5YaZqDEhfRk4f6RONDWoEdEOj5SQe
+    dmn0N92knxBOxMUNv4bpFgCyErZaeZSykoTboNZOOS2MqA3zY8oOJX8wV9kLiqT2
+    JzYVQZasE7lEUnTqdWbWVtc2LLJp8GWy/L5JeldiEwBhKXgy70v7ZYKH9wPYvvrm
+    qi23/uKYiDaEu/Z5kJbIaIwZqrxrLzmgUktrzlQf+slBduHewBY9U3xTM3dLWduR
+    TDMNLkGhIGadYKE4n376FTNDgR23hABZD+EkkSrQberqpahORANE5T4dveW0CEta
+    9J6ujWVaf5Rn+kFM4YgbvQVpJzM5VP6ZmntO4T+pCRMAuvzFbZs=
+    -----END CERTIFICATE-----