feat: expose AUTH_TLS_CAFILE for custom CA certificate on JWKS endpoint

[nathan-weinberg]

Summary

• Exposes the upstream-supported tls_cafile config field for the OAuth2 auth provider via the AUTH_TLS_CAFILE env var
• Allows deployments with self-signed or internal CA certificates to specify a CA bundle path for the JWKS endpoint, rather than disabling TLS verification entirely

Test plan

• Verify AUTH_TLS_CAFILE is accepted and used when set to a valid CA bundle path
• Verify existing AUTH_VERIFY_TLS behavior is unchanged
• Verify default behavior (no env var set) remains secure (TLS verification enabled)

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Added support for specifying a custom CA bundle when validating authentication JWKS over TLS.
  • Updated the bundled configuration to include the new TLS CA file option, enabling use of AUTH_TLS_CAFILE for JWKS verification.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: ed021d01-9ca4-430a-b57f-9a16f3380f4e

📥 Commits

Reviewing files that changed from the base of the PR and between 28ec2e7 and b31980c.

📒 Files selected for processing (1)

• Containerfile

🚧 Files skipped from review as they are similar to previous changes (1)

• Containerfile

---

📝 Walkthrough

Walkthrough

build/build.yaml and distribution/config.yaml add tls_cafile to the server auth JWKS TLS verification configuration, sourced from AUTH_TLS_CAFILE. Containerfile replaces the embedded base64-encoded config.yaml label payload to match the updated config. CWE-295 remains relevant for the TLS trust path; CWE-312 applies if the encoded payload contains sensitive data.

Estimated code review effort: 2 (Simple) | ~10 minutes

Changes

File	Change
build/build.yaml	Added tls_cafile under JWKS auth config
distribution/config.yaml	Added tls_cafile under server.auth.provider_config
Containerfile	Replaced base64-encoded config.yaml LABEL payload

Related issues: None provided
Related PRs: None provided
Suggested labels: security, config, supply-chain
Suggested reviewers: security reviewer

Poem:
TLS cafile enters the frame,
Encoded config stays the same no more;
CWE-295 watches trust,
CWE-312 on the label’s core.

🚥 Pre-merge checks | ✅ 9 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
No Hardcoded Secrets	⚠️ Warning	FAIL: Containerfile:29 adds a 13KB base64 config blob in a config file, which matches the check’s base64 secret heuristic (CWE-798/CWE-312).	Move the embedded YAML out of the Containerfile label or store it as plain generated config; avoid long base64 blobs in config files.

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: exposing AUTH_TLS_CAFILE for JWKS TLS verification via config updates.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Contribution Quality And Spam Detection	✅ Passed	PASS: This is a narrow config/env-var exposure for auth TLS CA bundles; the templated PR body is only one weak signal, with no second-category red flag.
No Weak Cryptography	✅ Passed	PASS: no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, no roll-your-own crypto, and the SHA-256 checksum check is artifact integrity, not secrets (no CWE-327/CWE-208).
No Injection Vectors	✅ Passed	No CWE-89/78/94/502/79 sink patterns in Containerfile or the YAML diffs; AUTH_TLS_CAFILE is only added as a static config/env field.
No Privileged Containers	✅ Passed	PASS: Containerfile/build.yaml/distribution/config.yaml add only TLS CA config; no privileged, host*, allowPrivilegeEscalation, runAsUser:0, USER root, or SYS_ADMIN markers (CWE-269).
No Sensitive Data In Logs	✅ Passed	No CWE-532 issue: touched files only add generic build/progress prints; no secrets, tokens, PII, request bodies, or credentials are logged.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mergify]

⚠️ Heads up! This PR modifies Containerfile.
A corresponding change may be needed in the Konflux Dockerfile: https://github.com/red-hat-data-services/ogx-distribution/blob/main/Dockerfile.konflux
Please verify if the changes need to be synchronized.

[derekhiggins]

lgtm,

ci failure looked unrelated, I've re triggered it

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request