vmauth: mount internal root CA + SSL_CERT_FILE for Keycloak OIDC discovery (fix x509)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-25 16:06:14 +09:00
parent 7ddb1f062d
commit 9fab760992
2 changed files with 24 additions and 9 deletions
@@ -24,6 +24,21 @@ resources:
    cpu: 200m
    memory: 128Mi

+# Keycloak(사내 CA 서명) OIDC discovery/JWKS 검증용 CA 마운트.
+# 없으면 vmauth가 issuer의 .well-known/openid-configuration을 TLS 검증 못 해(x509)
+# OIDC verifier 초기화 실패 → 모든 JWT 검증 불가(401). root-ca-cert는 사전조건 Secret.
+extraVolumes:
+  - name: ca-cert
+    secret:
+      secretName: root-ca-cert
+extraVolumeMounts:
+  - name: ca-cert
+    mountPath: /ca
+    readOnly: true
+env:
+  - name: SSL_CERT_FILE      # Go crypto/x509가 사내 CA를 신뢰하도록 지정
+    value: /ca/ca.crt
+
 config:
  users:
    # ── 권장: Keycloak JWT 검증 + vm_access 동적 라우팅 ──────────────────────