[STAC-24875] docs: configure trust stores from an existing secret

[VioletCranberry]

Configure trust stores from an existing secret

A trust store supplied as a Helm value is stored in the Helm release secret, which is subject to the 1MB limit of the underlying object in the cluster. It is counted against that limit twice, once as the value itself and once as the secret SUSE Observability renders from it. Trust stores are binary and do not compress, so a few hundred KB is enough on its own to make helm upgrade fail. A customer hit exactly this when upgrading to 2.10.

The chart now supports reading trust stores from a user-managed secret, the same pattern already used for passwords, licenses and API keys. These pages document it.

Chart side: StackVista/helm-charts-internal#153

Reviewing this PR

This branch was cut from main, so the commit list also contains the commits main has that staging does not. Only two files are actually changed by this work:

• docs/latest/modules/en/pages/use/security/self-signed-certificates.adoc
• docs/latest/modules/en/pages/setup/security/authentication/ldap.adoc

Compared against main the change is 1 commit, 2 files, +116 −2.

What changed

use/security/self-signed-certificates.adoc

• "Use a custom trust store" now leads with creating a secret via kubectl create secret generic and referencing it with stackstate.java.trustStoreFromExternalSecret in values.yaml. This also removes the need to repeat --set-file on every helm upgrade.
• New section "Trust stores and the Helm release secret size limit" explaining the limit, with a command to check whether an existing installation is affected and which values dominate its release secret.
• The previous --set-file instructions are preserved under a new heading, "Specify the trust store as a Helm value", and marked as subject to the size limit. The Base64 method is unchanged and still documented.
• Added a note that changing the secret does not restart pods, with the kubectl rollout restart command needed after rotating a trust store.

setup/security/authentication/ldap.adoc

• New "Using an existing secret" subsection covering trustStoreFromExternalSecret and trustCertificatesFromExternalSecret, noting that the two are configured independently and may live in different secrets.
• Both options added to the LDAP settings list, with a cross-reference to the size limit section.

Migration guidance

Both pages state that the inline values must be removed, not merely supplemented. The external secret takes precedence, so the trust store is mounted correctly either way, but any leftover inline value still counts against the release secret size limit. Without this, someone could follow the new instructions, see the trust store working, and still be unable to upgrade.

Version gating

The new values are only available from chart version 2.10.4, so both pages carry a note saying so, following the existing convention used for global.suseObservability and version 2.8.0.

Two things to confirm before this reaches published docs:

• If the chart change lands in a release other than 2.10.4, the version in both notes needs updating.
• Helm does not error on unknown values, so a user on an older chart who follows these instructions gets no warning, no mounted trust store, and puzzling TLS failures. The version note is what prevents that, which is why the number matters.

Test plan

• make ci-pr-link-check produces exactly the same warning and error counts as main (132 WARN, 152 ERROR), so no new issues are introduced. Note this target already exits non-zero on main, so that failure is pre-existing.
• Both pages render, and the new anchors _trust_stores_and_the_helm_release_secret_size_limit and _specify_the_trust_store_as_a_helm_value resolve, including the cross-page xref from the LDAP page.
• Only en/ is touched, since translations are handled by a separate pipeline.

Relates to STAC-24875

[netlify]

✅ Deploy Preview for suse-obs ready!

Name	Link
🔨 Latest commit	e72d2b7
🔍 Latest deploy log	https://app.netlify.com/projects/suse-obs/deploys/6a86fbc743608e0008ecb7fc
😎 Deploy Preview	https://deploy-preview-388--suse-obs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.