What is the key for truststore password?

[mokhos]

Hi, I'm having a problem configuring a truststore and its password in a secret in the values.yaml

It is written in the values.yaml regarding the truststore password:

  ## @param tls.truststorePassword Password for the truststore (use with caution - consider using existingSecret)
  truststorePassword: ""

As I don't want to configure the password as raw text in the values.yaml and would like to use the existing secret for the password, my question would be: What is the key for password?

I already tried: truststore-password, trust-store-password, truststorePassword

But I get this error:
ERROR [org.keycloak.quarkus.runtime.cli.ExecutionExceptionHandler] (main) ERROR: No trust store password provided

Would someone please help here? I'd be appreciated.

Chart Version: 0.6.6
App Version: 26.4.1

[Gugu7264]

Hi,

Looks like it's truststore.jks, and it's looking for a file with the same name.

helm-charts/charts/keycloak/templates/deployment.yaml

Lines 314 to 317 in 6fd22a6

	secretName: {{ .Values.tls.truststoreExistingSecret }}
	items:
	- key: truststore.jks
	path: truststore.jks

[dloewen2]

Yes this seems to be the correct way.
You can see this documented in the values here:

helm-charts/charts/keycloak/values.yaml

Lines 163 to 165 in 08e6bc1

	## @param tls.truststoreExistingSecret Name of existing secret containing truststore file (Java Keystore format)
	## The secret should contain 'truststore.jks' key
	truststoreExistingSecret: ""

[mokhos]

Thanks @Gugu7264, @dloewen2 for your response.

The problem is not with the truststore itself, but with its password. I have already created a secret with the key: truststore.jks like this:

---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: keycloak-truststore
  namespace: keycloak
spec:
  encryptedData:
    truststore.jks: ...
  template:
    metadata:
      name: keycloak-truststore
      namespace: keycloak

when I add another key for the password(like I said above) say trust-store-password, I get an error that no password is provided.
In other words I think KC_HTTPS_TRUST_STORE_PASSWORD env-variable is not populated correctly.

So what I did was to create another secret and then add it under extraEnvVarsSecret with the variable set to KC_HTTPS_TRUST_STORE_PASSWORD.

Please let me know if I'm wrong.

[Gugu7264]

Ah, sorry for not understanding your issue.

Indeed, it looks like the only supported way to provide the truststore password is using the .Values.tls.truststorePassword key. I'm not sure what the comment/documentation for that key means by:

(use with caution - consider using existingSecret)

I might have missed something else, maybe @dloewen2 knows about it, or it might be a missing feature

[dloewen2]

Thanks @mokhos for clarifying.
This indeed seems like a missing feature. Currently the password was given trough the args of the container only. So if not solved like you did it, the env wouldn't exist and the problem you had would happen.
This should be rather easy to add to the helm-chart. (Maybe some other args also need to be included like this to the envs)

[dloewen2]

I created the PR #574
This should fix the problem and create a better configuration.

[zOnlyKroks]

the fix has been merged

[ZAZmaster]

Hello! When i try use truststore

  ## @param tls.truststoreEnabled Enable truststore for client certificate validation or outgoing HTTPS requests
  truststoreEnabled: true
  ## @param tls.truststoreExistingSecret Name of existing secret containing truststore file (Java Keystore format)
  ## The secret should contain 'truststore.jks' key or the key specified in the value 'tls.truststoreExistingSecretKey'
  truststoreExistingSecret: "keycloak-truststore"
  ## @param tls.truststoreExistingSecretKey Key of the secret to get the trustStorePassword from
  truststoreExistingSecretKey: "truststore.jks"
  ## @param tls.truststorePassword Password for the truststore (use with caution - consider using existingSecret)
  truststorePassword: "changeit"
  ## @param tls.truststoreFile Path where the truststore file will be mounted (internal)
  truststoreFile: "/opt/keycloak/truststore/truststore.jks"

an error occurs while creating a container:

Error: failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: invalid environment variable "KC_HTTPS_TRUST_STORE_PASSWORD": value contains nul byte (\x00): unknown

Chart Version: 0.11.3
App Version: 26.4.7

[dloewen2]

With your values the helm-charts expects the https-trust-store-password in you existingSecret keycloak-truststore in the key truststore.jks. You can leave the key truststorePassword empty, as it will not be considered.
Can you check if your password and secret exists in the given secret in the namespace you are trying to deploy this chart to?

[mokhos]

Hello @ZAZmaster,
I was also a bit confused with the change, but turned out the truststoreExistingSecretKey must be set to the key which your password is set to. In my case truststoreExistingSecretKey: "truststore-password". When you set it like this, you don't need the truststorePassword: "changeit" anymore.

[dloewen2]

exactly like @mokhos explained.
The naming is probably not the best, but the keys *SecretKey are values you can set to configure which keys from your existingSecret will be used to map to the env-vars in the deployment/statefulset.

[ZAZmaster]

@mokhos Thanks, this helped me solve my problem and understand the logic behind the naming.