Workspace components have to use provided custom certificates

[tolusha]

Is your enhancement related to a problem? Please describe.

We face the issue when Eclipse Che is deployed behind a proxy with custom certificate
https://issues.redhat.com/browse/CRW-1054

The reason is the following:

Clients that expect to make proxy connections must use the trusted-ca-bundle for all HTTPS requests to the proxy, and may use the trusted-ca-bundle for non-proxy HTTPS requests as well.

https://docs.openshift.com/container-platform/4.4/rest_api/config_apis/proxy-config-openshift-io-v1.html

Describe the solution you'd like

Once is done #17407 Theia (+git) should use the provided certificates.

[ibuziuk]

Closed accidentally. setting P1 priority

[RickJWagnerTest1]

This is an important issue. Please see comments on CRW-1054 for more context. Thank you!

[azatsarynnyy]

Hello,
currently, Che Theia expects a certificate in /tmp/che/secret/ca.crt.
@tolusha am I understand it right that now Che Theia should check a certificate in /public-certs/*.crt first and then in /tmp/che/secret/ca.crt if no certificate in /public-certs folder?

[tolusha]

/plublic-certs folder contains additional certificates
theia should use all of them

/cc @mmorhun

[mmorhun]

@azatsarynnyy it should use both. Ideally we should have everything in one place.
Moreover, might happen that /tmp/che/secret/ca.crt is also included into /public-certs/*, however it should not be handled manually by us, but by the corresponding tools/libs (for example axios lib should have ca bundle option).

[azatsarynnyy]

Thanks, @mmorhun!
Currently, we provide /tmp/che/secret/ca.crt to axios but it also can consume an array of CAs.
https://github.com/eclipse/che-theia/blob/a6dba7bace2ca71046f16737e16a4e27c7efb013/extensions/eclipse-che-theia-plugin-ext/src/node/che-plugin-service.ts#L150

Another question is can we expect that an additional cert file will be named /public-certs/ca.crt?

[tolusha]

@azatsarynnyy
The only fact we can rely on:
/public-certs is a directory with CA files (not necessary the only one).

[azatsarynnyy]

@azatsarynnyy
The only fact we can rely on:
/public-certs is a directory with CA files (not necessary the only one).

@tolusha /public-certs/*.crt or /public-certs/*?

[tolusha]

/public-certs/*.crt