Kirill Ilin 2afcaf365a feat(keycloak): let the KMS proxy trust a private Vault CA ...

The proxy could only reach a Vault whose certificate chains to a publicly
trusted root, so a Vault fronted by an internal load balancer with a
self-signed certificate was unreachable over HTTPS.

Allow the CA to be supplied inline (caBundle, the chart renders the Secret) or
as a pre-seeded Secret (caSecretName), mounted and exposed as SSL_CERT_FILE.
That redirects only the system trust store, which nothing but the Vault client
consults — the database leg verifies against its own CA pool.

Assisted-By: Claude AI
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>
(cherry picked from commit 3531553176)

2026-08-28 07:29:22 +00:00

..

apps

Prepare release v1.6.2 (promoted from v1.6.2-rc.1)

2026-08-19 07:31:23 +00:00

core

Pin promoted packages artifact for v1.6.2

2026-08-19 07:31:25 +00:00

extra

Prepare release v1.6.2 (promoted from v1.6.2-rc.1)

2026-08-19 07:31:23 +00:00

library

fix(backups): cover Go-driven system-bucket ObjectStore + share the checksum helper

2026-08-12 07:46:22 +00:00

system

feat(keycloak): let the KMS proxy trust a private Vault CA

2026-08-28 07:29:22 +00:00

tests/cozy-lib-tests

feat(cozy-lib): add CA-only TLS trust-anchor helper for tenants

2026-06-23 03:12:17 +03:00