wireapp / wireapp/wire-server-deploy
missing possibility to add CA certs to brig and galley pods
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 113
- Forks
- 44
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
I want to add a bot to my platform. The bot is hosted behind an https URL with a certificate generated by an internal CA.
I cannot add the bot in the conversation (PinInvalidCert error)
After debugging, it's because brig and galley pods only accepts bot URLs with self-signed certs or certs generated by a trusted CA.
I was able to install our internal CA cert on the pods like this:
vi /usr/local/share/ca-certificates/internal_ca.crt
paste the crt content
update-ca-certificates
But it's a bit complicated to do that on each pod recreation.
Could you modify brig and galley charts so that we can specify somewhere one or multiple internal CA crt files?
Maybe method3 from this URL: https://medium.com/@paraspatidar/add-self-signed-or-ca-root-certificate-in-kubernetes-pod-ca-root-certificate-store-cb7863cb3f87
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the brig and galley charts and their pod templates first, then compare the linked Kubernetes CA-certificate approach with the current pod setup. Done means users can configure one or more internal CA certificate files in the charts, the certificates survive pod recreation, and bot URLs using that CA are accepted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100