CHE-14527: Support git clone for repos with self-signed SSL certs #15084

vparfonov · 2019-11-04T14:04:48Z

What does this PR do?

Support git clone for repos with self-signed SSL certs
CHE-14527: Support git clone for repos with self-signed SSL certs

How it works:

For testing on my laptop I setup local git server which support cloning my https (e.g. https://gogs.io/) pretty easy for installation.
After successfully deploy Eclipse on minikube need to execute next command:
kubectl create configmap che-git-self-signed-cert --from-file=ca.crt --from-literal=githost={host}:{port} -n=che
where:

ca.crt - your self-signed certificate 
{host}:{port} - host and port for HTTPS connection on your git server.

Now you can create and start new workspace.
On each container of your workspace will be mount special volume that contains file with your self-signed certificate and to the gitconfig section with information about git server host and path to the certificate. E.g.

[http "https://10.33.177.118:3000"]
        sslCAInfo = /etc/che/git/cert/cert.pem

What issues does this PR fix or reference?

#14527

Release Notes

Docs PR

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

che-bot · 2019-11-04T14:14:16Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15084

Tested with Eclipse Che Single User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

che-bot · 2019-11-04T14:22:42Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:15084
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

deploy/kubernetes/helm/che/values.yaml

Co-Authored-By: Sergii Leshchenko <sleshche@redhat.com>

che-bot · 2019-11-05T07:17:44Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15084

Tested with Eclipse Che Single User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

che-bot · 2019-11-05T08:07:44Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:15084
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

sleshchenko

In general LGTM.

The idea with multiple self-signed certs definitely can be implemented in the scope of a separate issue if it's valid and important.

Let me know when my inline comments are addressed and PR is ready to review.

sleshchenko · 2019-11-07T12:01:56Z

deploy/kubernetes/helm/che/templates/deployment.yaml

+
+        # If git-self-signed-cert is used then configure Che Server with certificate content
+        # to propagate it to trust store
+        {{- if .Values.global.useGitSelfSignedCerts }}


I wonder if we can with minimal changes support multiple self-signed certs for different hosts?
On one hand it's quite easy to imagine config map like

data: my-git.com:9232: --BEGINCERT adssaxxxxxx -- my-another-git.org:3716: --BEGINCERT adssaxxxxxx --

On another hand, it's not clear how to inject each property to the server. Ways I see:

Just configure SecretName for Che Server, and then Che Server will ready it from K8s API and propagate to workspaces.

Mount whole secret as a folder, where files names are hosts, and content - is ca.cert. And let Che Server know where these folder is mount.

sleshchenko · 2019-11-07T12:02:25Z

...va/org/eclipse/che/workspace/infrastructure/kubernetes/KubernetesEnvironmentProvisioner.java

    private final PreviewUrlExposer<KubernetesEnvironment> previewUrlExposer;
+    private VcsSslCertificateProvisioner vcsSslCertificateProvisioner;


please add final

sleshchenko · 2019-11-07T12:07:30Z

.../eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSslCertificateProvisioner.java

+  static final String CHE_GIT_SELF_SIGNED_CERT_CONFIG_MAP_SUFFIX = "-che-git-self-signed-cert";
+  static final String CHE_GIT_SELF_SIGNED_VOLUME = "che-git-self-signed-cert";
+  static final String CERT_MOUNT_PATH = "/etc/che/git/cert/";
+  static final String CA_CERT_FILE = "cert.pem";


Could you elaborate on what is the purpose of injecting ca.crt and propagate it as cert.pem.
Would not it be more straightforward to propagate certificate as initially configured ca.crt?

sleshchenko · 2019-11-07T12:12:09Z

.../eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSslCertificateProvisioner.java

+    this.host = host;
+  }
+
+  /** @return true only if */


true only if what? 😄

sleshchenko · 2019-11-07T12:12:59Z

.../eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSslCertificateProvisioner.java

+
+  public String getGitServerHost() {
+    if (isNullOrEmpty(host)) {
+      return nullToEmpty(host);


Can you elaborate more about what will happen if host is empty? Is it a valid case? Then git will use such a certificate for everything?

sleshchenko · 2019-11-07T12:15:48Z

.../eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSslCertificateProvisioner.java

+    return CERT_MOUNT_PATH + CA_CERT_FILE;
+  }
+
+  public String getGitServerHost() {


I would not expect from this method to return server host with escaped ".
I think it's specific to gitconfig constructing and you append " in GitConfigProvisioner instead

sleshchenko · 2019-11-07T12:17:41Z

typescript-dto/package.json

@@ -1,10 +1,13 @@
 {
  "name": "@eclipse-che/api",
-  "version": "7.4.0-SNAPSHOT",
+  "version": "7.4.0-7a47579",


Seems it's not related to changes that you described in PR description

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

che-bot · 2019-11-13T15:03:16Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:15084
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

che-bot · 2019-11-13T15:08:04Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15084

Tested with Eclipse Che Single User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

che-bot · 2019-11-13T15:17:56Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: maxura/che-server:15084

Tested with Eclipse Che Single User on K8S (minikube v1.1.1)

⚠️ https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

ℹ️ Use comment "crw-ci-test" to rerun happy path E2E test.

che-bot · 2019-11-13T15:36:19Z

E2E tests of Eclipse Che Multiuser on OCP has failed:

Build details
Test report
docker image: eclipseche/che-server:15084
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.
Use command "ci-test" to rerun the test.

vparfonov added 12 commits October 16, 2019 16:06

Initial commit

aaedd58

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

v7.4.0-7a47579

8de1544

Merge branch 'master' of github.com:eclipse/che

fae2ef6

Merge branch 'master' into che#14527

a6e352e

Add provisioner for SSL cert

73ddc03

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

Merge branch 'master' of github.com:eclipse/che

3a11981

Add config for certificate

49ca9bd

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

Add host configuration

cb92c4c

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

Rename classes on more suitable

9238043

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

Merge branch 'master' of github.com:eclipse/che

9cd2cc1

Merge branch 'master' into che#14527

a723f62

Add tests

22d4738

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

che-bot added status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. kind/task Internal things, technical debt, and to-do tasks to be performed. labels Nov 4, 2019

sleshchenko reviewed Nov 4, 2019

View reviewed changes

deploy/kubernetes/helm/che/values.yaml Outdated Show resolved Hide resolved

Update deploy/kubernetes/helm/che/values.yaml

368e707

Co-Authored-By: Sergii Leshchenko <sleshche@redhat.com>

Merge branch 'master' of github.com:eclipse/che

af63697

sleshchenko reviewed Nov 7, 2019

View reviewed changes

vparfonov added 4 commits November 8, 2019 10:10

Merge branch 'master' of github.com:eclipse/che

c5df71f

Merge branch 'master' of github.com:eclipse/che

ed98924

Merge branch 'master' of github.com:eclipse/che

6b2d834

Code cleanup

15f3c36

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

Add OpenShift support

da683ba

Signed-off-by: Vitalii Parfonov <vparfono@redhat.com>

vparfonov closed this Nov 21, 2019

vparfonov deleted the che#14527 branch February 18, 2020 08:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CHE-14527: Support git clone for repos with self-signed SSL certs #15084

CHE-14527: Support git clone for repos with self-signed SSL certs #15084

vparfonov commented Nov 4, 2019 •

edited

che-bot commented Nov 4, 2019

che-bot commented Nov 4, 2019

che-bot commented Nov 5, 2019

che-bot commented Nov 5, 2019

sleshchenko left a comment

sleshchenko Nov 7, 2019

sleshchenko Nov 7, 2019

sleshchenko Nov 7, 2019

sleshchenko Nov 7, 2019

sleshchenko Nov 7, 2019

sleshchenko Nov 7, 2019

sleshchenko Nov 7, 2019

che-bot commented Nov 13, 2019

che-bot commented Nov 13, 2019

che-bot commented Nov 13, 2019

che-bot commented Nov 13, 2019

		private final PreviewUrlExposer<KubernetesEnvironment> previewUrlExposer;
		private VcsSslCertificateProvisioner vcsSslCertificateProvisioner;

CHE-14527: Support git clone for repos with self-signed SSL certs #15084

CHE-14527: Support git clone for repos with self-signed SSL certs #15084

Conversation

vparfonov commented Nov 4, 2019 • edited

What does this PR do?

How it works:

What issues does this PR fix or reference?

Release Notes

Docs PR

che-bot commented Nov 4, 2019

che-bot commented Nov 4, 2019

che-bot commented Nov 5, 2019

che-bot commented Nov 5, 2019

sleshchenko left a comment

Choose a reason for hiding this comment

sleshchenko Nov 7, 2019

Choose a reason for hiding this comment

sleshchenko Nov 7, 2019

Choose a reason for hiding this comment

sleshchenko Nov 7, 2019

Choose a reason for hiding this comment

sleshchenko Nov 7, 2019

Choose a reason for hiding this comment

sleshchenko Nov 7, 2019

Choose a reason for hiding this comment

sleshchenko Nov 7, 2019

Choose a reason for hiding this comment

sleshchenko Nov 7, 2019

Choose a reason for hiding this comment

che-bot commented Nov 13, 2019

che-bot commented Nov 13, 2019

che-bot commented Nov 13, 2019

che-bot commented Nov 13, 2019

vparfonov commented Nov 4, 2019 •

edited