Incomplete propagation of the trusted bundle CA certificates to the workspaces

[davidfestal]

Describe the bug

With the Che operator the ca-certs config map (mentioned in the spec.server.ServerTrustStoreConfigMapName custom resource field) has a double purpose:

• First on OpenShift it allows injecting cluster-wide OpenShift trusted certificates inside Che (through the use of the config.openshift.io/inject-trusted-cabundle="true" label)
• But also it allows manually adding additional untrusted CA certificates as additional key in this Config Map, so that they would be trusted by Che, as described in the Docs PR: https://github.com/eclipse/che-docs/pull/1598/files

The bug is that the manually added certificates are not propagated up to the workspaces when creating the ca-certs config map in the workspace namespace.

Che version

• latest
• nightly
• other: please specify

Steps to reproduce

• Install Che with applygin the steps defined in this docs PR doc
• Create a workspace from this Che installation
• This should create a ca-certs ConfigMap in the namespace of the workspace

Expected behavior

The ca-certs config map in the workspace namespace should contain all the keys you manually added in the Che operator ca-certs ConfigMap at installation, but it doesn't.

Runtime

• kubernetes (include output of kubectl version)
• Openshift (include output of oc version)
• minikube (include output of minikube version and kubectl version)
• minishift (include output of minishift version and oc version)
• docker-desktop + K8S (include output of docker version and kubectl version)
• other: (please specify)

Screenshots

Installation method

• chectl
  • provide a full command that was used to deploy Eclipse Che (including the output)
  • provide an output of chectl version command
• OperatorHub
• I don't know

Environment

• my computer
  • Windows
  • Linux
  • macOS
• Cloud
  • Amazon
  • Azure
  • GCE
  • other (please specify)
• other: please specify

Eclipse Che Logs

Additional context

The error is obviously coming from the fact that the Che server creates a new empty map with the config.openshift.io/inject-trusted-cabundle="true" label in the Workspace namespace, instead of simply creating / updating a config map with the exact same content of the Che Operator ca-certs config map.

[davidfestal]

@tolusha please complete or correct the description of the bug

[davidfestal]

If we want the docs about importing untrusted CAs to be consistent and useful for the CRW 2.5.0 release, then we should probably also treat this issue as a blocker for the CRW 2.5.0 release.

cc @l0rd @nickboldt

[davidfestal]

@mshaposhnik Has the corresponding fix been cherry-picked to the main branch before closing this issue ?

cf #18264 (comment)

[mshaposhnik]

@davidfestal Yes, here it is 6c03073