From b456e8a5da3fe391f9b0a311d56cdfa0509d6156 Mon Sep 17 00:00:00 2001
From: ivan <ivan@MacBook-Air-som-tillhor-ivan.local>
Date: Thu, 5 Nov 2026 11:18:05 +0500
Subject: [PATCH] =?UTF-8?q?uralkal:=20zitadel=20=E2=80=94=20=D0=B4=D0=BE?=
 =?UTF-8?q?=D0=B2=D0=B5=D1=80=D0=B8=D0=B5=20=D0=BA=D0=BE=D1=80=D0=BD=D0=B5?=
 =?UTF-8?q?=D0=B2=D0=BE=D0=BC=D1=83=20CA=20BER-CA1=20=D0=B4=D0=BB=D1=8F=20?=
 =?UTF-8?q?LDAPS=20=D0=BA=20AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ConfigMap uralkali-ca с PEM BER-CA1 (DC=local,DC=uralkali,DC=com) монтируется
в /etc/ssl/uralkali, SSL_CERT_DIR=/etc/ssl/uralkali:/etc/ssl/certs. Образ на
scratch без пересборки: Go берёт доп. корни из SSL_CERT_DIR. Чинит
"x509: certificate signed by unknown authority" при входе через AD.
---
 .../zitadel/uralkal/kustomization.yaml        |  1 +
 .../zitadel/uralkal/uralkali-ca.yaml          | 29 +++++++++++++++++++
 infrastructure/zitadel/uralkal/zitadel.yaml   | 10 +++++++
 3 files changed, 40 insertions(+)
 create mode 100644 infrastructure/zitadel/uralkal/uralkali-ca.yaml

diff --git a/infrastructure/zitadel/uralkal/kustomization.yaml b/infrastructure/zitadel/uralkal/kustomization.yaml
index 17fee7c..0359752 100644
--- a/infrastructure/zitadel/uralkal/kustomization.yaml
+++ b/infrastructure/zitadel/uralkal/kustomization.yaml
@@ -2,5 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ../base
+  - uralkali-ca.yaml
 patches:
   - path: zitadel.yaml
diff --git a/infrastructure/zitadel/uralkal/uralkali-ca.yaml b/infrastructure/zitadel/uralkal/uralkali-ca.yaml
new file mode 100644
index 0000000..d5b63d7
--- /dev/null
+++ b/infrastructure/zitadel/uralkal/uralkali-ca.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: uralkali-ca
+  namespace: zitadel
+data:
+  ber-ca1.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIDsjCCApqgAwIBAgIQAXfxtRjCJrpJcAhO6t1LBzANBgkqhkiG9w0BAQsFADBY
+    MRMwEQYKCZImiZPyLGQBGRYDY29tMRgwFgYKCZImiZPyLGQBGRYIdXJhbGthbGkx
+    FTATBgoJkiaJk/IsZAEZFgVsb2NhbDEQMA4GA1UEAxMHQkVSLUNBMTAeFw0yMDAz
+    MjMwNTI3MzBaFw0yODAzMjMwNTM3MjlaMFgxEzARBgoJkiaJk/IsZAEZFgNjb20x
+    GDAWBgoJkiaJk/IsZAEZFgh1cmFsa2FsaTEVMBMGCgmSJomT8ixkARkWBWxvY2Fs
+    MRAwDgYDVQQDEwdCRVItQ0ExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+    AQEAnVGFDQfYgVNIsQv6uBVKKAudUwnmVq2781uCpDXPuVet84DfjAmYNcNgz45I
+    qikJPnkqcAtZimkQ8znmb7If2aQs1qPZ/7pSVhJU4Revode8jy2vpYPBXpbIw4pc
+    2Z8xWSP88hDWkkVcwze8GoFuVxKtikVaj4HCkWYikGpdKDko6f1sCj+K89kPEK11
+    l/0ij754c6cC5cyGy0XV5CqVpqZcef+aGu3P+835Skii2s+2j/EmmW9uiHQ7y6fl
+    OBqbn6tA8ofplhCDcfNSW76w1R2b+eH8X2RzJpIYKaVn/dQ6hdFjGzJAeSA4kzYl
+    XVv7rq2rEc7Bj1L1GgGCWh4puwIDAQABo3gwdjALBgNVHQ8EBAMCAYYwDwYDVR0T
+    AQH/BAUwAwEB/zAdBgNVHQ4EFgQUQ+2UXR7y3Q+vUIQBeS6uWsg0ogMwEgYJKwYB
+    BAGCNxUBBAUCAwMAAzAjBgkrBgEEAYI3FQIEFgQUd+FmCvlBWdlBdBK1bcGgDzrK
+    EUcwDQYJKoZIhvcNAQELBQADggEBAFxO66L5YaZqDEhfRk4f6RONDWoEdEOj5SQe
+    dmn0N92knxBOxMUNv4bpFgCyErZaeZSykoTboNZOOS2MqA3zY8oOJX8wV9kLiqT2
+    JzYVQZasE7lEUnTqdWbWVtc2LLJp8GWy/L5JeldiEwBhKXgy70v7ZYKH9wPYvvrm
+    qi23/uKYiDaEu/Z5kJbIaIwZqrxrLzmgUktrzlQf+slBduHewBY9U3xTM3dLWduR
+    TDMNLkGhIGadYKE4n376FTNDgR23hABZD+EkkSrQberqpahORANE5T4dveW0CEta
+    9J6ujWVaf5Rn+kFM4YgbvQVpJzM5VP6ZmntO4T+pCRMAuvzFbZs=
+    -----END CERTIFICATE-----
diff --git a/infrastructure/zitadel/uralkal/zitadel.yaml b/infrastructure/zitadel/uralkal/zitadel.yaml
index 7811374..31b27f3 100644
--- a/infrastructure/zitadel/uralkal/zitadel.yaml
+++ b/infrastructure/zitadel/uralkal/zitadel.yaml
@@ -155,3 +155,13 @@ spec:
         value: "zitadel-admin"
       - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
         value: "Sarex"
+      - name: SSL_CERT_DIR
+        value: "/etc/ssl/uralkali:/etc/ssl/certs"
+    extraVolumes:
+      - name: uralkali-ca
+        configMap:
+          name: uralkali-ca
+    extraVolumeMounts:
+      - name: uralkali-ca
+        mountPath: /etc/ssl/uralkali
+        readOnly: true