feat(platform): expose Keycloak truststores through platform values - #5144

What this PR does

Fixes #5140.

#5039 added truststores to the Keycloak chart, but that capability was not reachable through the administrator-owned platform Package: the system bundle rendered Package cozystack.keycloak without a components override. This PR adds the optional authentication.oidc.keycloakTruststores platform value and forwards it unchanged to spec.components.keycloak.values.truststores on that child Package.

Administrators can configure it under spec.components.platform.values on Package cozystack.cozystack-platform:

authentication:
  oidc:
    keycloakTruststores:
      - configMapName: organization-ca
        key: ca.crt
      - secretName: partner-ca
        key: certificates.pem

When OIDC is enabled and the list is non-empty, the complete list is forwarded, including entry order, explicitly selected keys, and entries that omit key so the chart's ca.crt default remains effective. When the value is unset or explicitly empty, the platform continues to use the default Package helper without introducing spec.components. When OIDC is disabled, the value is ignored because no Keycloak Package is emitted.

The platform layer only forwards references; it does not create Secrets or ConfigMaps. Referenced objects and keys must already exist in cozy-keycloak, and the Keycloak chart remains responsible for validation and mounting. Its existing semantics are unchanged: trust applies server-wide across all realms, only public certificate material should be supplied, and changing an object's contents requires a Keycloak restart or a versioned object reference to reload the truststore.

Validation

• make test in packages/core/platform: all 295 tests pass. The new suite covers unset, empty and null defaults, complete list forwarding, false-y malformed values, both isp-full and isp-slim, and disabled OIDC; removing the forwarding path or restoring truthiness-based empty checks makes the regression suite fail.
• make test in packages/system/keycloak: all 121 tests pass.
• With the system bundle and OIDC enabled, the unset render is byte-identical to upstream/main. The explicitly empty case is separately verified to omit spec.components; malformed false-y values reach the Keycloak chart and are rejected by its existing truststores must be a list validation.
• make generate has no target in packages/core/platform; there are no generated platform schema artifacts to update.
• make show could not run because cozyhr is unavailable. A direct helm template render of the system bundle was checked in a temporary chart copy with templates/repository.yaml removed because its lookup requires a live source. This verifies rendering and forwarding, not a live-cluster deployment or an end-to-end Keycloak TLS connection.

Screenshots

Not applicable; no UI changes.

Downstream repositories

Changing packages/core/platform/values.yaml directly triggers the website's hand-written platform-package reference. The existing cozystack/website#765 follow-up covers both the chart-level value and this platform configuration path, including content/en/docs/next/operations/configuration/platform-package.md; no other downstream trigger applies to this diff.

• No downstream repository is affected by this change
• cozystack/website - follow-up: docs(keycloak): document custom CA truststores and platform configuration website#765 (covers the platform value and platform-package reference as well as the chart-level guide)
• cozystack/terraform-provider-cozystack - follow-up:
• cozystack/ansible-cozystack - follow-up:
• cozystack/ccp - follow-up:
• cozystack/talm - follow-up:
• cozystack/cozyhr - follow-up:
• cozystack/cozy-proxy - follow-up:
• cozystack/cozystack-telemetry-server - follow-up:
• cozystack/external-apps-example - follow-up:
• cozystack/examples - follow-up:
• cozystack/community - follow-up:

Release note

feat(platform): add `authentication.oidc.keycloakTruststores` so administrators can forward existing Secret or ConfigMap CA references from the platform Package to the bundled Keycloak server for private-CA LDAPS, external identity-provider, and SMTP TLS connections.

Summary by CodeRabbit

• New Features
  • Added the authentication.oidc.keycloakTruststores setting for configuring additional CA certificates from Secrets or ConfigMaps in cozy-keycloak. Certificate entries default to ca.crt, and configured certificates apply across all Keycloak realms.
  • The setting defaults to an empty list. Configured truststores are passed to Keycloak when OIDC is enabled; when OIDC is disabled, the setting is ignored and existing Keycloak package settings remain unchanged.