uralkal: camunda keycloak — доверие корневому CA BER-CA1 для LDAPS к AD

ConfigMap uralkali-ca с PEM BER-CA1 монтируется в /opt/uralkali-ca,
KC_TRUSTSTORE_PATHS=/opt/uralkali-ca/ber-ca1.crt добавляет его в Truststore SPI
Keycloak 25 поверх системных корней, без пересборки образа.

infrastructure/camunda/uralkal/camunda.yaml

@@ -221,7 +221,16 @@ spec:
         - name: krb5
           configMap:
             name: keycloak-krb5
+        - name: uralkali-ca
+          configMap:
+            name: uralkali-ca
+      extraEnvVars:
+        - name: KC_TRUSTSTORE_PATHS
+          value: /opt/uralkali-ca/ber-ca1.crt
       extraVolumeMounts:
+        - name: uralkali-ca
+          mountPath: /opt/uralkali-ca
+          readOnly: true
         - name: keytab
           mountPath: /opt/keytab
           readOnly: true

infrastructure/camunda/uralkal/kustomization.yaml

@@ -3,5 +3,6 @@ kind: Kustomization
 resources:
   - ../base
   - keycloak-krb5.yaml
+  - uralkali-ca.yaml
 patches:
   - path: camunda.yaml

infrastructure/camunda/uralkal/uralkali-ca.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uralkali-ca
+  namespace: camunda
+data:
+  ber-ca1.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDsjCCApqgAwIBAgIQAXfxtRjCJrpJcAhO6t1LBzANBgkqhkiG9w0BAQsFADBY
+    MRMwEQYKCZImiZPyLGQBGRYDY29tMRgwFgYKCZImiZPyLGQBGRYIdXJhbGthbGkx
+    FTATBgoJkiaJk/IsZAEZFgVsb2NhbDEQMA4GA1UEAxMHQkVSLUNBMTAeFw0yMDAz
+    MjMwNTI3MzBaFw0yODAzMjMwNTM3MjlaMFgxEzARBgoJkiaJk/IsZAEZFgNjb20x
+    GDAWBgoJkiaJk/IsZAEZFgh1cmFsa2FsaTEVMBMGCgmSJomT8ixkARkWBWxvY2Fs
+    MRAwDgYDVQQDEwdCRVItQ0ExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+    AQEAnVGFDQfYgVNIsQv6uBVKKAudUwnmVq2781uCpDXPuVet84DfjAmYNcNgz45I
+    qikJPnkqcAtZimkQ8znmb7If2aQs1qPZ/7pSVhJU4Revode8jy2vpYPBXpbIw4pc
+    2Z8xWSP88hDWkkVcwze8GoFuVxKtikVaj4HCkWYikGpdKDko6f1sCj+K89kPEK11
+    l/0ij754c6cC5cyGy0XV5CqVpqZcef+aGu3P+835Skii2s+2j/EmmW9uiHQ7y6fl
+    OBqbn6tA8ofplhCDcfNSW76w1R2b+eH8X2RzJpIYKaVn/dQ6hdFjGzJAeSA4kzYl
+    XVv7rq2rEc7Bj1L1GgGCWh4puwIDAQABo3gwdjALBgNVHQ8EBAMCAYYwDwYDVR0T
+    AQH/BAUwAwEB/zAdBgNVHQ4EFgQUQ+2UXR7y3Q+vUIQBeS6uWsg0ogMwEgYJKwYB
+    BAGCNxUBBAUCAwMAAzAjBgkrBgEEAYI3FQIEFgQUd+FmCvlBWdlBdBK1bcGgDzrK
+    EUcwDQYJKoZIhvcNAQELBQADggEBAFxO66L5YaZqDEhfRk4f6RONDWoEdEOj5SQe
+    dmn0N92knxBOxMUNv4bpFgCyErZaeZSykoTboNZOOS2MqA3zY8oOJX8wV9kLiqT2
+    JzYVQZasE7lEUnTqdWbWVtc2LLJp8GWy/L5JeldiEwBhKXgy70v7ZYKH9wPYvvrm
+    qi23/uKYiDaEu/Z5kJbIaIwZqrxrLzmgUktrzlQf+slBduHewBY9U3xTM3dLWduR
+    TDMNLkGhIGadYKE4n376FTNDgR23hABZD+EkkSrQberqpahORANE5T4dveW0CEta
+    9J6ujWVaf5Rn+kFM4YgbvQVpJzM5VP6ZmntO4T+pCRMAuvzFbZs=
+    -----END CERTIFICATE-----