libre.sh/keycloak-scim
3
0
Fork 0
Code Issues 15 Pull requests Releases 1 Packages Activity Actions

doc: add keycloak cr truststores (#28015)

Browse source 
closes: #27892

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
This commit is contained in:
Steven Hawkins 2024-03-22 03:27:15 -04:00 committed by GitHub
parent 3f9cebca39
commit 6cc66109d5
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 37 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
docs/guides/operator/advanced-configuration.adoc
View file

@ -205,4 +205,41 @@ It is achieved by providing certain JVM options.
For more details, see <@links.server id="containers" />.
=== Truststores
If you need to provide trusted certificates, the Keycloak CR provides a top level feature for configuring the server's truststore as discussed in <@links.server id="keycloak-truststore"/>.
Use the truststores stanza of the Keycloak spec to specify Secrets containing PEM encoded files, or PKCS12 files with extension `.p12` or `.pfx`, for example:
[source,yaml]
----
apiVersion: k8s.keycloak.org/v2alpha1
kind: Keycloak
metadata:
name: example-kc
spec:
...
truststores:
my-truststore:
secret:
name: my-secret
----
Where the contents of my-secret could be a PEM file, for example:
[source,yaml]
------
apiVersion: v1
kind: Secret
metadata:
name: my-secret
stringData:
cert.pem: |
-----BEGIN CERTIFICATE-----
...
------
When running on a Kubernetes or OpenShift environment well-known locations of trusted certificates are included automatically.
This includes /var/run/secrets/kubernetes.io/serviceaccount/ca.crt and the /var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt when present.
</@tmpl.guide>