SSL CERT FILE

• Unable to exchange token... tls: failed to verify certificate: x509: certificate signed by unknown authority

 # OIDC ENABLED
web:
  additionalEnvSecretName: temporal-web-sso-kc
 
  # Configuration for self signed certificates in your identity provider:
  #  
  # kubectl get secret YOUR_KEYCLOAK_TLS_SECRET_NAME -n YOUR_NAMESPACE -o jsonpath='{.data.ca\.crt}' | base64 -d >  /tmp/your_keycloak_cert.crt
  # openssl x509 -in /tmp/your_keycloak_cert.crt -noout -subject -issuer
  # cat /etc/ssl/certs/ca-certificates.crt /tmp/your_keycloak_cert > ca-bundle.crt
  #
  # kubectl create configmap temporal-ca-bundle --from-file=ca-bundle.crt -n YOUR_NAMESPACE

  additionalEnv:
    - name: SSL_CERT_FILE
      value: /custom-ca/ca-bundle.crt
  additionalVolumes:
    - name: temporal-ca
      configMap:
        name: temporal-ca-bundle
  additionalVolumeMounts:
    - name: temporal-ca
      mountPath: /custom-ca
      readOnly: true
  
# OIDC configuration 
extraObjects:
  - apiVersion: v1
    kind: Secret
    metadata:
      name: temporal-web-sso-kc
    stringData:
      TEMPORAL_AUTH_ENABLED: "true"
      TEMPORAL_AUTH_CLIENT_ID: "temporal"
      TEMPORAL_AUTH_CLIENT_SECRET: "XXXXXXX"        # kcadm.sh get clients -r YourRealm --fields clientId,secret
      TEMPORAL_AUTH_SCOPES: "openid,profile,email"
      TEMPORAL_AUTH_ISSUER_URL: "https://kc.example.org/realms/YOUR_REAL"
      TEMPORAL_AUTH_PROVIDER_URL: "https://kc.example.org/realms/YOUR_REAL"
      TEMPORAL_AUTH_CALLBACK_URL: "https://temporal.example.orgo/auth/sso/callback"

See also

• Temporal.io, Temporal Cloud, Temporal Server, tctl, tcld, helm install temporal, brew install temporal (CLI), temporalio/, temporal-sql-tool, Workflows, TEMPORAL TLS, Temporal OAUTH, dynamicConfig:, Dashboards, versions. Operations, /etc/temporal/, Worker deployment, Worker Versioning, Temporal Web UI, (envs), Temporal Java SDK, Versions, Namespace