From 04a3f4be569913deaabff49bbf4eaa0a3eb665b7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=A4=D0=B5=D0=B4=D0=BE=D1=80=20=D0=91=D0=B0=D1=82=D0=BE?= =?UTF-8?q?=D0=BD=D0=BE=D0=B3=D0=BE=D0=B2?= Date: Wed, 21 Oct 2026 16:04:18 +0300 Subject: [PATCH] docs(keycloak): clarify incoming mTLS trust scope MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The system truststore also verifies HTTPS client certificates unless a separate HTTPS truststore is configured. Operators adding an LDAP CA need to know that this can extend inbound TLS trust as well. Assisted-by: LLM Signed-off-by: Федор Батоногов --- packages/system/keycloak/values.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/packages/system/keycloak/values.yaml b/packages/system/keycloak/values.yaml index 1d974cac4..9209baf5b 100644 --- a/packages/system/keycloak/values.yaml +++ b/packages/system/keycloak/values.yaml @@ -102,7 +102,7 @@ extraEnv: [] # name: my-secret # key: my-key -# Additional trust anchors for outbound TLS (LDAPS, external IdPs, SMTP). +# Additional system trust anchors (LDAPS, external IdPs, SMTP). # Each entry selects one key from an existing Secret or ConfigMap in the # release namespace; key defaults to ca.crt. Supply only public certificates: # PEM bundles or unencrypted PKCS12 (.p12, .pfx, .pkcs12), without private keys. @@ -111,6 +111,9 @@ extraEnv: [] # The chart reserves the cozystack-* subdirectories there for these mounts. # These CAs apply to the whole Keycloak server, across all realms, so restrict # writes to the referenced objects to administrators who manage that trust. +# They also verify incoming client certificates when https-client-auth is +# request or required and no separate https-trust-store-file is configured. +# Set that file explicitly if incoming mTLS needs a different trust boundary. # Changing an object's contents does not restart Keycloak: restart both pods # after rotation, or change the referenced object name to trigger a rollout. # Missing objects/keys prevent the pod from starting. Certificate