Implement additional CA bundle propogation for non-OpenShift 4 infrastructures #17634
Labels
area/install
Issues related to installation, including offline/air gap and initial setup
kind/enhancement
A feature request - must adhere to the feature request template.
severity/P2
Has a minor but important impact to the usage or development of the system.
Milestone
Is your enhancement related to a problem? Please describe.
As of now, cluster CA bundle might be propagated to Che components only on Openshift 4 infrastructure.
This should be also supported on Kubernetes and Openshift 3
Describe the solution you'd like
In case of Openshift 4 (only) it is possible to request from the Openshift cluster a config map with CA bundle, which then is propagated to Che components by Che. In case of other platforms we may require the configmap from a user (Che admin) instead of requesting it from the cluster. However, please note, that CA bundle provided by Openshift cluster many certs including commonly trusted one. And I do not think that it makes sense to request them all in case of manual config map creating. So here we have to merge (not replace) this configmap's certs with Che component's trust stores (it is done in most - if not all - cases).
Additional context
This is actual if due to some reasons, some endpoints is secured by other CA certificates. For example: external SSO, proxy with SSL Bump, a resource (a project as zip file) served outside cluster or inside cluster but with custom TLS certificate and so on...
The text was updated successfully, but these errors were encountered: