wireapp / wireapp/wire-server-deploy

missing possibility to add CA certs to brig and galley pods

Open
#250 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Shell
Stars
113
Forks
44
PR merge metrics
No merged PRs in 30d

Description

Hello,
I want to add a bot to my platform. The bot is hosted behind an https URL with a certificate generated by an internal CA.
I cannot add the bot in the conversation (PinInvalidCert error)
After debugging, it's because brig and galley pods only accepts bot URLs with self-signed certs or certs generated by a trusted CA.
I was able to install our internal CA cert on the pods like this:
vi /usr/local/share/ca-certificates/internal_ca.crt
paste the crt content
update-ca-certificates
But it's a bit complicated to do that on each pod recreation.
Could you modify brig and galley charts so that we can specify somewhere one or multiple internal CA crt files?
Maybe method3 from this URL: https://medium.com/@paraspatidar/add-self-signed-or-ca-root-certificate-in-kubernetes-pod-ca-root-certificate-store-cb7863cb3f87

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect the brig and galley charts and their pod templates first, then compare the linked Kubernetes CA-certificate approach with the current pod setup. Done means users can configure one or more internal CA certificate files in the charts, the certificates survive pod recreation, and bot URLs using that CA are accepted.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.