WildFly Elytron Native PEM KeyStore for Kubernetes TLS Secrets
This project adds native PEM keystore support to WildFly Elytron, enabling WildFly to load Kubernetes TLS secrets directly without any manual conversion. Kubernetes exposes TLS certificates and private keys as PEM files, typically as tls.crt and tls.key. Elytron currently requires JKS or PKCS12 keystores, which creates unnecessary friction when deploying applications in containerized environments. This project introduces a new KeyStoreSpi implementation that reads PEM-encoded certificates and private keys from separate files and exposes them as a standard keystore type (PEM). The implementation integrates seamlessly with Elytron’s existing KeyManager and TrustManager infrastructure, allowing it to be used transparently in current configurations. The main deliverables include a robust PEM parser, the PemKeyStoreSpi implementation, support for separate certificate and key files, Elytron configuration integration, comprehensive test coverage, validation using Kubernetes-style TLS secrets, and clear user documentation.
Project details
Technologies
Not listed in the archive