Keycloak API - ability to skip certification verification

[eanders]

Merging this PR

• use the squash-merge strategy for PRs targeting main

Description

• Adds the ability to skip SSL certificate verification for when the keycloak is hosted with a self-signed certificate

Type of change

• New feature

Checklist before requesting review

• I performed a self-review of my code
• I ran the OP review skill
• I ran the code that is being changed under ideal conditions, and it doesn't fail
• If adding a new endpoint / exposing data in a new way, I have:
  • ensured the API can't leak data from other data sources
  • ensured this does not introduce N+1s
  • ensured permissions and visibility checks are performed in the right places
• Any major architectural changes are supported by an approved ADR (Architectural Decision Record)
• I updated the documentation (or not applicable)
• I added spec tests (or not applicable)
• I provided testing instructions in this PR or the related issue (or not applicable)

[ttoomey]

Looks good, maybe guard production so it's always true if we intend this to only be qa/staging/dev

[ttoomey]

maybe return true if Rails.env.production?

[eanders]

Oh, stupid AI, that comment isn't correct. The skip is because our infrastructure uses a different domain with a self-signed certificate for internal communication, not because of the environment.

[ttoomey]

I see, so the risk is then that there's no verification when making API requests to keycloak in prod or fetching an access token. Definitely not ideal.

But since we control the network and hosts, this has probably low practical risk. A different story if it's an external IDP; that seems riskier.

Should we flag this as a work-around and plan a follow up get validation working?

[ttoomey]

wonder if we could just make the self-signed certs part of our image

[eanders]

@yakloinsteak can you weigh in here? It sounded like you had some potential solutions, but felt the self-signed cert was sufficient.

[yakloinsteak]

I feel that the self-signed cert is sufficient, but this could be a good opportunity to improve things. All of our load balancers talk to our services with self-signed certs, but @ttoomey's point is valid for sure.

We can use kyverno to copy the CA from the keycloak namespace to the rails namespace and mount it, and there are a number of tools that can can get what we need in the rails namespace (but I figure they aren't worth it since we already have kyverno).

It's maybe a few hours work to get this set up. Tack this on to https://github.com/greenriver/devops-requests/issues/2770 if you want to try it out.

[eanders]

Moving back to draft, until we determine timing of better certificates on the back-channel communications.

[yakloinsteak]

https://github.com/greenriver/argocd-manifests/pull/4279 should be ready for review soon, and in the meantime, /app/config/keycloak/ca.crt is where the ca will live, but let me know if you need an env var with that path.