Propagate custom public certificate to env variable #171

vinokurig · 2020-02-14T10:09:54Z

Add a property to configure propagation of custom public certificate from config-map to environment variable

eclipse-che/che#16002

che-bot · 2020-02-14T10:09:56Z

Can one of the admins verify this patch?

Signed-off-by: Igor Vinokur <ivinokur@redhat.com>

vinokurig · 2020-02-14T12:33:34Z

Docs PR: eclipse-che/che-docs#1078

tolusha · 2020-02-14T14:44:03Z

@vinokurig
You shouldn't manually update cr/crd file.
If you update che_types.go then follow the instruction:

// Important: You should regenerate some generated code after modifying this file. At the root o fthe project:
// - Run "operator-sdk generate k8s": this will perform required changes in the "pkg/apis/org/v1/zz_generatedxxx" files
// - Run "operator-sdk generate openapi": this will generate the "deploy/crds/org_v1_checluster_crd.yaml" file
// - In the updated "deploy/crds/org_v1_checluster_crd.yaml": Delete all the `required:` openAPI rules in the CRD OpenApi schema.
// - Rename the new "deploy/crds/org_v1_checluster_crd.yaml" to "deploy/crds/org_v1_che_crd.yaml" to override it.
// IMPORTANT These 2 last steps are important to ensure backward compatibility with already existing `CheCluster` CRs that were created when no schema was provided.

tolusha · 2020-02-14T14:45:51Z

/cc @mmorhun

tolusha

If there is no any specific reason to merge it before 7.9.0 I would like to postpone it.

vinokurig · 2020-02-17T10:06:13Z

@tolusha

You shouldn't manually update cr/crd file.
If you update che_types.go then follow the instruction:

Fixed

vinokurig · 2020-02-17T13:03:22Z

@tolusha

You shouldn't manually update cr/crd file.
If you update che_types.go then follow the instruction:

Done

pkg/apis/org/v1/che_types.go

deploy/crds/org_v1_che_cr.yaml

pkg/deploy/deployment_che.go

sleshchenko · 2020-02-25T09:11:03Z

pkg/deploy/deployment_che.go

@@ -158,6 +179,9 @@ func NewCheDeployment(cr *orgv1.CheCluster, cheImageAndTag string, cmRevision st
 									},
 								},
 							},
+							VolumeMounts: []corev1.VolumeMount{
+                                customPublicCertsVolumeMount,


It seems to be wrong formatted

fixed the formatting

tolusha · 2020-02-25T14:32:02Z

@vinokurig
One more step is required

cd olm
./update-nightly-olm-files.sh

And include the generated files into PR

vinokurig · 2020-02-25T15:16:10Z

@tolusha

One more step is required
cd olm
./update-nightly-olm-files.sh
And include the generated files into PR

Done

davidfestal

Mainly OK with the changes, but let one comment about automatic rolling update of the Che server deployment when the custom certs are changed.

davidfestal · 2020-02-26T15:42:31Z

pkg/controller/che/che_controller.go

 	effectiveGitSelfSignedCert := r.GetDeploymentEnvVarSource(effectiveCheDeployment, "CHE_GIT_SELF__SIGNED__CERT") != nil
 	if desiredMemRequest.Cmp(effectiveMemRequest) != 0 ||
 		desiredMemLimit.Cmp(effectiveMemLimit) != 0 ||
 		effectiveImagePullPolicy != desiredImagePullPolicy ||
 		effectiveSelfSignedCert != desiredSelfSignedCert ||
+		effectiveCustomPublicCerts != desiredCustomPublicCerts ||


It seems that a change in the content of the config map will not trigger a redeploy of the impacted components (mainly the Che server).
You might want to also support this case by doing the same way as what is done for the che config map (with the current config map resource version being added as a metadata in the Che deployment itself).

@tolusha Do we want to support automatic rolling update of the Che server when the custom public certs config map content is changed ?

yes. it make sense.

I have no idea how to check the certificates config-map changed state. In case of the che config-map there is a predefined list of values which is compared with the actual values, but the certificates config map hasn't any predefined values. @tolusha @AndrienkoAleksandr @mmorhun @davidfestal WDYT?

vinokurig · 2020-03-03T13:43:57Z

[ci-test]

flacatus · 2020-03-03T15:04:40Z

[test]

vinokurig requested a review from tolusha February 14, 2020 10:09

vinokurig requested review from davidfestal, l0rd, nickboldt, rhopp and vparfonov as code owners February 14, 2020 10:09

Add an ability to add public key certificate to Java trust store

190f223

Signed-off-by: Igor Vinokur <ivinokur@redhat.com>

vinokurig force-pushed the che-16002 branch from 433a54e to 190f223 Compare February 14, 2020 10:16

vinokurig mentioned this pull request Feb 14, 2020

Add an ability to add public key certificate to Java trust store eclipse-che/che#16006

Merged

tolusha requested changes Feb 15, 2020

View reviewed changes

fixup! Add an ability to add public key certificate to Java trust store

cd3618d

sleshchenko reviewed Feb 19, 2020

View reviewed changes

pkg/apis/org/v1/che_types.go Show resolved Hide resolved

deploy/crds/org_v1_che_cr.yaml Outdated Show resolved Hide resolved

pkg/deploy/deployment_che.go Outdated Show resolved Hide resolved

Merge branch 'master' of github.com:eclipse/che-operator into che-16002

0279895

vinokurig force-pushed the che-16002 branch 3 times, most recently from a888fc5 to 036955d Compare February 21, 2020 15:10

fixup! Add an ability to add public key certificate to Java trust store

a84c59d

vinokurig force-pushed the che-16002 branch from 036955d to a84c59d Compare February 21, 2020 15:19

fixup! Add an ability to add public key certificate to Java trust store

dcba90c

sleshchenko reviewed Feb 25, 2020

View reviewed changes

vinokurig added 2 commits February 25, 2020 11:52

fixup! Add an ability to add public key certificate to Java trust store

5f8c68e

fixup! Add an ability to add public key certificate to Java trust store

d2c5a52

vinokurig force-pushed the che-16002 branch from 40499cb to d2c5a52 Compare February 25, 2020 10:25

vinokurig mentioned this pull request Feb 25, 2020

Add instructions for adding custom ssl cert to trust store eclipse-che/che-docs#1078

Merged

vinokurig added 2 commits February 25, 2020 17:13

Merge branch 'master' of github.com:eclipse/che-operator into che-16002

06d06cd

fixup! Add an ability to add public key certificate to Java trust store

4496e97

vinokurig force-pushed the che-16002 branch from 7184e08 to 4496e97 Compare February 25, 2020 15:14

tolusha approved these changes Feb 26, 2020

View reviewed changes

davidfestal reviewed Feb 26, 2020

View reviewed changes

vinokurig force-pushed the che-16002 branch from d0cb98a to 4496e97 Compare February 27, 2020 10:33

vinokurig added 2 commits February 27, 2020 14:15

Merge branch 'master' of github.com:eclipse/che-operator into che-16002

c67fbdf

fixup! Add an ability to add public key certificate to Java trust store

295dcaa

ericwill mentioned this pull request Feb 28, 2020

Che Plugins Sprint 180 eclipse-che/che#16083

Closed

21 tasks

fixup! Add an ability to add public key certificate to Java trust store

8e39fdc

AndrienkoAleksandr approved these changes Mar 3, 2020

View reviewed changes

vinokurig merged commit f288238 into master Mar 4, 2020

vinokurig deleted the che-16002 branch March 4, 2020 08:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Propagate custom public certificate to env variable #171

Propagate custom public certificate to env variable #171

vinokurig commented Feb 14, 2020 •

edited

Loading

che-bot commented Feb 14, 2020

vinokurig commented Feb 14, 2020

tolusha commented Feb 14, 2020

tolusha commented Feb 14, 2020

tolusha left a comment

vinokurig commented Feb 17, 2020

vinokurig commented Feb 17, 2020

sleshchenko Feb 25, 2020

vinokurig Feb 25, 2020

tolusha commented Feb 25, 2020

vinokurig commented Feb 25, 2020

davidfestal left a comment

davidfestal Feb 26, 2020

tolusha Feb 27, 2020

vinokurig Feb 28, 2020 •

edited

Loading

vinokurig commented Mar 3, 2020

flacatus commented Mar 3, 2020

Propagate custom public certificate to env variable #171

Propagate custom public certificate to env variable #171

Conversation

vinokurig commented Feb 14, 2020 • edited Loading

che-bot commented Feb 14, 2020

vinokurig commented Feb 14, 2020

tolusha commented Feb 14, 2020

tolusha commented Feb 14, 2020

tolusha left a comment

Choose a reason for hiding this comment

vinokurig commented Feb 17, 2020

vinokurig commented Feb 17, 2020

sleshchenko Feb 25, 2020

Choose a reason for hiding this comment

vinokurig Feb 25, 2020

Choose a reason for hiding this comment

tolusha commented Feb 25, 2020

vinokurig commented Feb 25, 2020

davidfestal left a comment

Choose a reason for hiding this comment

davidfestal Feb 26, 2020

Choose a reason for hiding this comment

tolusha Feb 27, 2020

Choose a reason for hiding this comment

vinokurig Feb 28, 2020 • edited Loading

Choose a reason for hiding this comment

vinokurig commented Mar 3, 2020

flacatus commented Mar 3, 2020

vinokurig commented Feb 14, 2020 •

edited

Loading

vinokurig Feb 28, 2020 •

edited

Loading