Uploaded image for project: 'Red Hat OpenShift Dev Spaces (formerly CodeReady Workspaces) '
  1. Red Hat OpenShift Dev Spaces (formerly CodeReady Workspaces)
  2. CRW-6792

Leverage the Openshift cluster-wide Custom CA Bundle configuration

XMLWordPrintable

    • False
    • None
    • False
    • Release Notes, Compatibility/Configuration, User Experience
    • Hide
      = Leverage the Openshift cluster-wide Custom CA Bundle configuration for CDEs

      Communications with external services are encrypted with TLS and require the certificates to be signed by trusted Certificate Authorities (CA). Therefore, all untrusted CA chains used by external services should be imported to Dev Spaces.

      Starting from this release, labeled ConfigMaps from the installation namespace are used as sources for TLS certificates.
      The ConfigMaps can have an arbitrary amount of keys with an arbitrary amount of certificates each. The operator merges all ConfigMaps into a single one titled `ca-certs-merged`, and mounts it as a volume in the operands and Cloud Development Environment (CDE) pods.

      By default, the operator mounts the `ca-certs-merged` ConfigMap in a user's CDE at two locations: `/public-certs` and `/etc/pki/ca-trust/extracted/pem`. The `/etc/pki/ca-trust/extracted/pem` directory is where the system stores extracted CA certificates for trusted certificate authorities on Red Hat (e.g. CentOS, Fedora). CLI tools automatically use certificates from the system-trusted locations when the user's CDE is up and running.

      Learn more about the procedure in the link:https://docs.redhat.com/en/documentation/red_hat_openshift_dev_spaces/3.18/html/administration_guide/configuring-devspaces#importing-untrusted-tls-certificates[official documentation].
      Show
      = Leverage the Openshift cluster-wide Custom CA Bundle configuration for CDEs Communications with external services are encrypted with TLS and require the certificates to be signed by trusted Certificate Authorities (CA). Therefore, all untrusted CA chains used by external services should be imported to Dev Spaces. Starting from this release, labeled ConfigMaps from the installation namespace are used as sources for TLS certificates. The ConfigMaps can have an arbitrary amount of keys with an arbitrary amount of certificates each. The operator merges all ConfigMaps into a single one titled `ca-certs-merged`, and mounts it as a volume in the operands and Cloud Development Environment (CDE) pods. By default, the operator mounts the `ca-certs-merged` ConfigMap in a user's CDE at two locations: `/public-certs` and `/etc/pki/ca-trust/extracted/pem`. The `/etc/pki/ca-trust/extracted/pem` directory is where the system stores extracted CA certificates for trusted certificate authorities on Red Hat (e.g. CentOS, Fedora). CLI tools automatically use certificates from the system-trusted locations when the user's CDE is up and running. Learn more about the procedure in the link: https://docs.redhat.com/en/documentation/red_hat_openshift_dev_spaces/3.18/html/administration_guide/configuring-devspaces#importing-untrusted-tls-certificates [official documentation].
    • Enhancement
    • Done

      Today, DevSpaces requires a manual configuration to communicate with Git servers using self-signed TLS certs. Thos procedure is described here in section 3.4.3 of the Admin Guide.

      Openshift already has a cluster-wide configuration procedure to add custom CA bundles globally to the cluster. It would be useful if the DevSpaces Operator could check if this configuration is already present in the cluster and leverage it automatically without requiring the user to create yet another ConfigMap just for DevSpaces.

      This is how a Openshift cluster-admin configure custom trusted CA bundles on Openshift https://docs.openshift.com/container-platform/4.16/networking/configuring-a-custom-pki.html

              abazko Anatolii Bazko
              rafael.soares Rafael Soares
              Shmaraiev Oleksandr Shmaraiev Oleksandr
              Jana Vrbkova Jana Vrbkova
              Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: