cannot initialize workspace: unable to get local issuer certificate

[jgallucci32]

Describe the bug

Workspace cannot initialize due to Custom CA certifiate used by Gitlab. It fails to launch with this error

cannot initialize workspace: cannot initialize workspace: cannot initialize workspace: git initializer: git clone https://gitlab.devlnk.net/john.gallucci/bisf-cli.git . failed (exit status 128): Cloning into '.'... fatal: unable to access 'https://gitlab.devlnk.net/john.gallucci/bisf-cli.git/': SSL certificate problem: unable to get local issuer certificate

Steps to reproduce

1. Deploy Gitpod into Kubernetes
2. Integrate with Gitlab which uses an HTTPS with a Custom CA certificate
3. Launch Workspace

Expected behavior

Workspace launches

Additional information

Red Hat 7.8 (Docker CE 19.03)
Kubernetes 17.5.1
Gitpod Self-hosted v0.4.0

Example repository

n/a

[jgallucci32]

I was successfully able to workaround this issue by doing the following:

1. Create Kubernetes secret custom-ca-certificates with trusted root CA certificates:

cd /path/to/custom/ca/bundle
kubectl -n gitpod-selfhosted create secret generic custom-ca-certificates --from-file=ca-certificates.crt=ca-bundle.crt

2. Manually add the volume: and volumeMounts: parameters to the ws-sync.yaml deployment file to overwrite the trusted certificate authorities:

#   spec:
#     containers:
#       volumeMounts:
        - mountPath: /etc/ssl/certs/ca-certificates.crt
          name: ca-certificates
          subPath: ca-certificates.crt
#     volumes:
      - name: ca-certificates
        secret:
          defaultMode: 420
          secretName: custom-ca-certificates

4. Redeploy ws-sync pod

[fullmetalrooster]

We usually use letsencrypt to avoid problems with a custom CA as docker is also not working with self-signed certificates.

[jgallucci32]

@wulfthimm Let's Encrypt is not an option in our environment. In addition to internal web servers using custom-signed certs, we also require support for SSL web inspection at the internet boundary. The good news is I have a working Gitpod environment where Docker, image-builder, server, and ws-sync pods are all working with Custom CA certificates using a similar approach in my previous comment.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.