CHE-14527: Support git clone for repos with self-signed SSL certs #15084
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,152 @@ | ||
| /* | ||
| * Copyright (c) 2012-2018 Red Hat, Inc. | ||
| * This program and the accompanying materials are made | ||
| * available under the terms of the Eclipse Public License 2.0 | ||
| * which is available at https://www.eclipse.org/legal/epl-2.0/ | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 | ||
| * | ||
| * Contributors: | ||
| * Red Hat, Inc. - initial API and implementation | ||
| */ | ||
| package org.eclipse.che.workspace.infrastructure.kubernetes.provision; | ||
|
|
||
| import static com.google.common.base.Strings.isNullOrEmpty; | ||
| import static java.util.Collections.singletonMap; | ||
|
|
||
| import com.google.common.annotations.VisibleForTesting; | ||
| import com.google.inject.Inject; | ||
| import io.fabric8.kubernetes.api.model.ConfigMapBuilder; | ||
| import io.fabric8.kubernetes.api.model.ConfigMapVolumeSourceBuilder; | ||
| import io.fabric8.kubernetes.api.model.Container; | ||
| import io.fabric8.kubernetes.api.model.Volume; | ||
| import io.fabric8.kubernetes.api.model.VolumeBuilder; | ||
| import io.fabric8.kubernetes.api.model.VolumeMount; | ||
| import io.fabric8.kubernetes.api.model.VolumeMountBuilder; | ||
| import java.util.Optional; | ||
| import javax.inject.Named; | ||
| import javax.inject.Singleton; | ||
| import org.eclipse.che.api.core.model.workspace.runtime.RuntimeIdentity; | ||
| import org.eclipse.che.api.workspace.server.spi.InfrastructureException; | ||
| import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment; | ||
| import org.eclipse.che.workspace.infrastructure.kubernetes.environment.KubernetesEnvironment.PodData; | ||
|
|
||
| /** | ||
| * Mount configured self-signed certificate for git provider as file in each workspace machines if | ||
| * configured. | ||
| * | ||
| * @author Vitalii Parfonov | ||
| */ | ||
| @Singleton | ||
| public class VcsSslCertificateProvisioner | ||
| implements ConfigurationProvisioner<KubernetesEnvironment> { | ||
| static final String CHE_GIT_SELF_SIGNED_CERT_CONFIG_MAP_SUFFIX = "-che-git-self-signed-cert"; | ||
| static final String CHE_GIT_SELF_SIGNED_VOLUME = "che-git-self-signed-cert"; | ||
| static final String CERT_MOUNT_PATH = "/etc/che/git/cert/"; | ||
| static final String CA_CERT_FILE = "ca.crt"; | ||
|
|
||
| @Inject(optional = true) | ||
| @Named("che.git.self_signed_cert") | ||
| private String certificate; | ||
|
|
||
| @Inject(optional = true) | ||
| @Named("che.git.self_signed_cert_host") | ||
| private String host; | ||
|
|
||
| public VcsSslCertificateProvisioner() {} | ||
|
|
||
| @VisibleForTesting | ||
| VcsSslCertificateProvisioner(String certificate, String host) { | ||
| this.certificate = certificate; | ||
| this.host = host; | ||
| } | ||
|
|
||
| /** | ||
| * @return true only if system configured for using self-signed certificate fot https git | ||
| * operation | ||
| */ | ||
| public boolean isConfigured() { | ||
| return !isNullOrEmpty(certificate); | ||
| } | ||
|
|
||
| /** @return path to the certificate file */ | ||
| public String getCertPath() { | ||
| return CERT_MOUNT_PATH + CA_CERT_FILE; | ||
| } | ||
|
|
||
| /** | ||
| * Return given in configuration git server host. | ||
| * | ||
| * @return git server host for git config it configured | ||
| */ | ||
| public String getGitServerHost() { | ||
|
There was a problem hiding this comment. I would not expect from this method to return server host with escaped |
||
| return host; | ||
| } | ||
|
|
||
| @Override | ||
| public void provision(KubernetesEnvironment k8sEnv, RuntimeIdentity identity) | ||
| throws InfrastructureException { | ||
| if (!isConfigured()) { | ||
| return; | ||
| } | ||
| String selfSignedCertConfigMapName = | ||
| identity.getWorkspaceId() + CHE_GIT_SELF_SIGNED_CERT_CONFIG_MAP_SUFFIX; | ||
| k8sEnv | ||
| .getConfigMaps() | ||
| .put( | ||
| selfSignedCertConfigMapName, | ||
| new ConfigMapBuilder() | ||
| .withNewMetadata() | ||
| .withName(selfSignedCertConfigMapName) | ||
| .endMetadata() | ||
| .withData(singletonMap(CA_CERT_FILE, certificate)) | ||
| .build()); | ||
|
|
||
| for (PodData pod : k8sEnv.getPodsData().values()) { | ||
| Optional<Volume> certVolume = | ||
| pod.getSpec() | ||
| .getVolumes() | ||
| .stream() | ||
| .filter(v -> v.getName().equals(CHE_GIT_SELF_SIGNED_VOLUME)) | ||
| .findAny(); | ||
|
|
||
| if (!certVolume.isPresent()) { | ||
| pod.getSpec().getVolumes().add(buildCertVolume(selfSignedCertConfigMapName)); | ||
| } | ||
|
|
||
| for (Container container : pod.getSpec().getInitContainers()) { | ||
| provisionCertVolumeMountIfNeeded(container); | ||
| } | ||
| for (Container container : pod.getSpec().getContainers()) { | ||
| provisionCertVolumeMountIfNeeded(container); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| private void provisionCertVolumeMountIfNeeded(Container container) { | ||
| Optional<VolumeMount> certVolumeMount = | ||
| container | ||
| .getVolumeMounts() | ||
| .stream() | ||
| .filter(vm -> vm.getName().equals(CHE_GIT_SELF_SIGNED_VOLUME)) | ||
| .findAny(); | ||
| if (!certVolumeMount.isPresent()) { | ||
| container.getVolumeMounts().add(buildCertVolumeMount()); | ||
| } | ||
| } | ||
|
|
||
| private VolumeMount buildCertVolumeMount() { | ||
| return new VolumeMountBuilder() | ||
| .withName(CHE_GIT_SELF_SIGNED_VOLUME) | ||
| .withNewReadOnly(true) | ||
| .withMountPath(CERT_MOUNT_PATH) | ||
| .build(); | ||
| } | ||
|
|
||
| private Volume buildCertVolume(String configMapName) { | ||
| return new VolumeBuilder() | ||
| .withName(CHE_GIT_SELF_SIGNED_VOLUME) | ||
| .withConfigMap(new ConfigMapVolumeSourceBuilder().withName(configMapName).build()) | ||
| .build(); | ||
| } | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I wonder if we can with minimal changes support multiple self-signed certs for different hosts?
On one hand it's quite easy to imagine config map like
On another hand, it's not clear how to inject each property to the server. Ways I see: