Claude/disable ssl verification

docs/data-sources/builtin-toolsets/github-mcp.md

@@ -102,7 +102,8 @@ Before deploying the GitHub MCP server, you need a GitHub Personal Access Token
                   key: token
             # Uncomment for GitHub Enterprise:
             # - name: GITHUB_HOST
-            #   value: "github.mycompany.com"
+            #   value: "https://github.mycompany.com"
+            # For self-signed certs, see "SSL Certificate Verification Errors" in Troubleshooting.
             resources:
               requests:
                 memory: "256Mi"
@@ -200,7 +201,7 @@ Before deploying the GitHub MCP server, you need a GitHub Personal Access Token
         auth:
           secretName: "github-mcp-token"
         config:
-          host: "github.mycompany.com"
+          host: "https://github.mycompany.com"
     ```
 
     Then deploy or upgrade your Holmes installation:
@@ -242,7 +243,7 @@ Before deploying the GitHub MCP server, you need a GitHub Personal Access Token
           auth:
             secretName: "github-mcp-token"
           config:
-            host: "github.mycompany.com"
+            host: "https://github.mycompany.com"
     ```
 
     Then deploy or upgrade your Robusta installation:
@@ -444,6 +445,84 @@ kubectl exec -n YOUR_NAMESPACE deployment/github-mcp-server -- \
   curl -I https://github.mycompany.com/api/v3
 ```
 
+### SSL Certificate Verification Errors
+
+**Problem:** Getting SSL certificate verification errors when connecting to GitHub Enterprise with self-signed or internal CA certificates
+
+**Solution:** Provide your organization's CA certificate to properly validate the connection:
+
+**Step 1:** Create a Kubernetes secret with your CA certificate:
+
+```bash
+kubectl create secret generic github-ca-cert \
+  --from-file=ca.crt=/path/to/your/ca-certificate.crt \
+  -n <NAMESPACE>
+```
+
+**Step 2:** Configure the GitHub MCP addon to use the CA certificate:
+
+=== "Holmes Helm Chart"
+
+    ```yaml
+    mcpAddons:
+      github:
+        enabled: true
+        auth:
+          secretName: "github-mcp-token"
+        config:
+          host: "https://github.mycompany.com"
+          customCACert:
+            enabled: true
+            # secretName: "github-ca-cert"  # default
+            # secretKey: "ca.crt"           # default
+    ```
+
+=== "Robusta Helm Chart"
+
+    ```yaml
+    holmes:
+      mcpAddons:
+        github:
+          enabled: true
+          auth:
+            secretName: "github-mcp-token"
+          config:
+            host: "https://github.mycompany.com"
+            customCACert:
+              enabled: true
+    ```
+
+=== "Holmes CLI (Manual Deployment)"
+
+    Add volume, volumeMount, and environment variables to your deployment:
+
+    ```yaml
+    spec:
+      containers:
+      - name: github-mcp
+        env:
+        - name: GITHUB_PERSONAL_ACCESS_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: github-mcp-token
+              key: token
+        - name: GITHUB_HOST
+          value: "https://github.mycompany.com"
+        - name: SSL_CERT_FILE
+          value: /etc/ssl/certs/ca.crt
+        - name: SSL_CERT_DIR
+          value: /etc/ssl/certs
+        volumeMounts:
+        - name: ca-cert
+          mountPath: /etc/ssl/certs
+          readOnly: true
+      volumes:
+      - name: ca-cert
+        secret:
+          secretName: github-ca-cert
+          defaultMode: 420
+    ```
+
 ### Tool Not Found Errors
 
 **Problem:** Holmes reports a tool is not available

helm/holmes/templates/mcp-servers/github/deployment.yaml

@@ -97,6 +97,12 @@ spec:
         - name: GITHUB_HOST
           value: {{ .Values.mcpAddons.github.config.host | quote }}
         {{- end }}
+        {{- if .Values.mcpAddons.github.config.customCACert.enabled }}
+        - name: SSL_CERT_FILE
+          value: /etc/ssl/certs/{{ .Values.mcpAddons.github.config.customCACert.secretKey }}
+        - name: SSL_CERT_DIR
+          value: /etc/ssl/certs
+        {{- end }}
         resources:
           {{- toYaml .Values.mcpAddons.github.resources | nindent 10 }}
         readinessProbe:
@@ -109,6 +115,19 @@ spec:
             port: 8000
           initialDelaySeconds: 10
           periodSeconds: 30
+        {{- if .Values.mcpAddons.github.config.customCACert.enabled }}
+        volumeMounts:
+        - name: ca-cert
+          mountPath: /etc/ssl/certs
+          readOnly: true
+        {{- end }}
+      {{- if .Values.mcpAddons.github.config.customCACert.enabled }}
+      volumes:
+      - name: ca-cert
+        secret:
+          secretName: {{ .Values.mcpAddons.github.config.customCACert.secretName }}
+          defaultMode: 420
+      {{- end }}
 ---
 apiVersion: v1
 kind: Service

helm/holmes/values.yaml

@@ -347,9 +347,15 @@ mcpAddons:
 
     config:
       # GitHub Enterprise hostname (leave empty for github.com)
-      # Example: "github.mycompany.com"
+      # Example: "https://github.mycompany.com"
       host: ""
 
+      # Custom CA certificate bundle for GitHub Enterprise with internal CA
+      customCACert:
+        enabled: false
+        secretName: "github-ca-cert"
+        secretKey: "ca.crt"
+
       # Toolsets to enable (comma-separated list of toolset names)
       # Available: repos, issues, pull_requests, actions, code_security, users, context, etc.
       # Default: repos, issues, pull_requests, actions (covers most investigation needs)