Add custom CA for Keycloak OIDC from Helm chart

[nbisson]

Hi,

I deployed Neuvector by using neuvector-helm-chart and I would like to add the authentification by Keycloak (Open ID Connect).

My values.yaml configuration :

controller:
  secret:
    enabled: true
    data:
      oidcinitcfg.yaml:
        Issuer: https://KEYCLOAK_URL/auth/realms/REALM
        Client_ID: neuvector
        Client_Secret: CLIENT_SECRET
        Scopes:
          - openid
          - profile
          - email
        Enable: true
        Default_Role: reader

However, I got the following error :

2022-09-19T11:58:57.914|ERRO|CTL|rest.handlerAuthLoginServer: User login failed - error=Post "https://KEYCLOAK_URL/auth/realms/REALM/protocol/openid-connect/token": x509: certificate signed by unknown authority server=openId1 

The workaround would be to implement the ability to add your own CA from the chart. By adding the following content in the controller, the authentication works :

        volumeMounts:
        - mountPath: /etc/ssl/certs
          name: ca-volume
          readOnly: true
#...
      volumes:
      - name: ca-volume
        projected:
          defaultMode: 420
          sources:
          - configMap:
              name: custom-ca

What do you think about adding your own CA in the helm chart ?

[laugmanuel]

+1 from me. We want to use our internal ADFS as OIDC provider for NeuVector, but this also requires a custom RootCA.

[raz0r-r]

Extra volumes and volumeMounts should really be standard for all controllers in a chart.
Also, If there could be a mechanism via values that adds the supplied configmap/secret certs to the default path/store with an automatic update-ca-certificates or similar, that would be great.

[rodneyxr]

Really needing this. We're having to manually patch the manager and controller deployments to do this. Could we get #513 merged in please?