Harbor LDAP over TLS: Supplying Custom CA Certificates

Question

Harbor LDAP over TLS: Supplying Custom CA Certificates
The goal is to allow Harbor’s LDAP authentication module to trust a self‑signed or internal CA‑signed LDAP server certificate without altering the host’s global trust store or disabling verification.
Current Harbor releases (2.0‑2.12) rely on the Go LDAP library’s default certificate pool, and the external_ca_cert secret introduced in 2.13+ is not automatically consumed by the LDAP component. There is no exposed UI field or documented configuration knob to inject additional CA material specifically for LDAPS connections.
Given these constraints, what options exist for administrators to provide a custom trust anchor to the LDAP module while maintaining secure TLS validation?

Is there a supported configuration parameter or secret that can be used to supply a custom CA bundle to Harbor’s LDAP authentication?
Can the existing external_ca_cert mechanism be extended to cover the LDAP component, or must a separate trust store be managed?
Should administrators consider alternative approaches such as sidecar containers or init containers to update the container’s certificate pool, and what are the implications for pod restart and consistency?

Tasadduq Burney · Answer

Harbor LDAP over TLS: Supplying Custom CA Certificates
Administrators have three practical ways to make Harbor’s LDAP module trust a self‑signed or internally‑signed LDAPS certificate while keeping the host trust store untouched.
Likely Explanation
The Go LDAP library used by Harbor reads the operating system’s CA bundle at start‑up. In Harbor releases 2.0‑2.12 there is no configuration key or secret that the LDAP component consumes, and the external_ca_cert secret introduced in 2.13 only secures Harbor’s own HTTPS endpoint. Consequently, the only reliable method is to augment the container’s trust store with the required PEM file.
Confirmed Facts

The external_ca_cert secret is not read by the LDAP authentication module.
No documented Harbor configuration parameter exists to inject a custom CA bundle for LDAPS.
Updating the system trust store inside the Harbor container is the supported way to add a new root certificate.

Recommended Steps

Identify the CA PEM file that signs the LDAP server certificate.
If using a Helm chart, create a ConfigMap that contains the PEM file (e.g., ldap-ca.crt).
Mount the ConfigMap as a volume into the Harbor pod at /etc/ssl/certs/extra. Example volume definition:
volumeMounts:
- name: ldap-ca
  mountPath: /etc/ssl/certs/extra
volumeSources:
- configMap:
    name: ldap-ca-config

Restart the affected Harbor pods so the Go LDAP process re‑reads the updated trust store.
Verify the addition by running ldapsearch -x -H ldaps://ldap.example.com and confirming that the handshake succeeds without “certificate not trusted” errors.

If you prefer not to modify the main container, you can run an init container that copies the PEM into /etc/ssl/certs before Harbor starts, or deploy a sidecar that periodically syncs the bundle. Both approaches require a pod restart or a rolling update to propagate the change to all replicas.
Please confirm your Harbor version (2.0‑2.12 or 2.13+) so we can determine whether the external_ca_cert secret might be leveraged for this use case.

Harbor LDAP over TLS: Supplying Custom CA Certificates