Harbor LDAP over TLS: Supplying Custom CA Certificates

Harbor LDAP over TLS: Supplying Custom CA Certificates

The goal is to allow Harbor’s LDAP authentication module to trust a self‑signed or internal CA‑signed LDAP server certificate without altering the host’s global trust store or disabling verification.

Current Harbor releases (2.0‑2.12) rely on the Go LDAP library’s default certificate pool, and the external_ca_cert secret introduced in 2.13+ is not automatically consumed by the LDAP component. There is no exposed UI field or documented configuration knob to inject additional CA material specifically for LDAPS connections.

Given these constraints, what options exist for administrators to provide a custom trust anchor to the LDAP module while maintaining secure TLS validation?

• Is there a supported configuration parameter or secret that can be used to supply a custom CA bundle to Harbor’s LDAP authentication?
• Can the existing external_ca_cert mechanism be extended to cover the LDAP component, or must a separate trust store be managed?
• Should administrators consider alternative approaches such as sidecar containers or init containers to update the container’s certificate pool, and what are the implications for pod restart and consistency?