keycloak: no way to add a private CA to the truststore (LDAPS, external IdP, SMTP) #3823

The system Keycloak has no way to trust a private CA, so any outbound TLS it initiates against an internal endpoint fails. The case that raised it in the community chat is an LDAPS user federation backed by an organisation's own CA; the same wall stands in front of an external OIDC identity provider or an SMTP server with an internal certificate.

Upstream handles this without ceremony: certificates dropped into conf/truststores are picked up automatically, as PEM or unencrypted PKCS12, and KC_TRUSTSTORE_PATHS points elsewhere if needed.

Our chart cannot deliver the file. packages/system/keycloak/templates/sts.yaml mounts only the themes volume and carries no extraVolumes or extraVolumeMounts, so there is no supported way to place a CA bundle into the container. Patching the StatefulSet by hand does not survive, Flux reconciles it back.

What would close it: a values field taking a Secret or ConfigMap reference, mounted read-only at /opt/keycloak/conf/truststores. No env var needed since Keycloak scans that directory on its own.

Raised here: https://t.me/cozystack_ru/12472