Gitlab: Enhance SSO CA functionality
We should be able to automagically trust the CA cert for end users for gitlab + keycloak/sso.
This secret is already created with the CA to trust. Currently for someone to make sure Gitlab mounts/uses this secret they have to add in values like this:
addons:
gitlab:
values:
global:
certificates:
customCAs:
- secret: tls-ca-sso
We should be able to modify the Gitlab BB values here and add something like:
{{- if and .Values.addons.gitlab.sso.enabled .Values.sso.certificate_authority}}
global:
certificates:
customCAs:
- secret: tls-ca-sso
{{- end }}
Should evaluate whether this works and whether this causes any side-effects. Note that Gitlab doesn't always need this CA mounted, but in my quick guesstimate it shouldn't matter:
- Gitlab doesn't trust the SSO cert: Would need it mounted, this will solve that
- Gitlab does trust SSO cert: Wouldn't need it, this would just add double trust (joke) - shouldn't affect what Gitlab trusts
For the gitlab passthrough values within BigBang, when entering in the second set of YAML above (the global.certificates.customCAs
section) we will need to make sure this override does not interfere or delete any customer customCAs
value overrides, so we will need to create a function similar to what we have for specific violations within Gatekeeper values for this global.certificates.customCAs
value for Gitlab.