Import all certificates from propagated bundles into Keycloak's truststore

[mmorhun]

Signed-off-by: Mykola Morhun [email protected]

What does this PR do?

Makes it possible to import several CA certificates from a single file into Keycloak's java trust store.

What issues does this PR fix or reference?

eclipse-che/che#18339

How to test this PR?

1. Create a *.pem file that contains several root CA certificates
2. Create a configmap with single data field which contains the *.pem file
3. Add the configmap as trusted for Che
4. Check that all CA certs are added into Keycloak's trust store

[mmorhun]

/test v4-che-operator-update

[davidfestal]

What about the Che server ? Don't we add certificates in the java truststore in the Che Java deployment as well ? Does it need the same fix ?

[davidfestal]

How do you manage the case where there are duplicate certificates (I assume we should be robust and ignore this error) ?
What about other errors when importing a certificate, Do we expect them to fail the start of the server ?

[mmorhun]

How do you manage the case where there are duplicate certificates (I assume we should be robust and ignore this error) ?

When adding a certificate into trust store we pass unique alias for it. So if user provides identical certificates - both will be added to trust store without any error.

What about other errors when importing a certificate, Do we expect them to fail the start of the server ?

Invalid certificates will not be imported, Keycloak and Che server will be started without invalid certificates

[davidfestal]

Thanks for the explanation.

[mmorhun]

What about the Che server ? Don't we add certificates in the java truststore in the Che Java deployment as well ? Does it need the same fix ?

@davidfestal already there: eclipse-che/che#18504

[davidfestal]

What about the Che server ? Don't we add certificates in the java truststore in the Che Java deployment as well ? Does it need the same fix ?

@davidfestal already there: eclipse/che#18504

Great ! Thanks !

[mmorhun]

@davidfestal do you have any other remarks?

[openshift-ci-robot]

New changes are detected. LGTM label has been removed.