Skip to content

Commit 5b30eb5

Browse files
aledbfaledbf
authored
Remove unused caCertSecret (#16793)
* Add trust.cert-manager.io for to bundle CA certificates Signed-off-by: Manuel de Brito Fontes <[email protected]> * Configure CA volume and volumemount in components * Update ws-manager golden files * Deploy trust manager in preview * Remove duplicated volume * Update installer golden files * Generate a bundle only for registry-facade * Update golden files * Fix initcontainer volume mounts * Update golden files * Fix registry-facade certificate * Update golden files * Disable skip_verify * Enable force conflict with apply server side Signed-off-by: Manuel de Brito Fontes <[email protected]> * Avoid random werft namespace errors Signed-off-by: Manuel de Brito Fontes <[email protected]> --------- Signed-off-by: Manuel de Brito Fontes <[email protected]>
1 parent 2155667 commit 5b30eb5

File tree

72 files changed

+4973
-3316
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+4973
-3316
lines changed

‎components/image-builder-mk3/cmd/setup.go

Lines changed: 0 additions & 35 deletions
This file was deleted.

‎components/registry-facade/cmd/setup.go

Lines changed: 3 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ package cmd
77
import (
88
"fmt"
99
"os"
10-
"os/exec"
1110
"path/filepath"
1211
"regexp"
1312

@@ -43,13 +42,15 @@ var setupCmd = &cobra.Command{
4342
}
4443

4544
// https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration
45+
// https://github.com/containerd/containerd/blob/main/docs/hosts.md
4646
hostsToml := fmt.Sprintf(`
4747
server = "https://%v:%v"
4848
4949
[host."https://%v:%v"]
5050
capabilities = ["pull", "resolve"]
5151
ca = "%v"
52-
skip_verify = true
52+
# skip verifications of the registry's certificate chain and host name when set to true
53+
#skip_verify = true
5354
`, hostname, port, hostname, port, filepath.Join(regDirectory, "ca.crt"))
5455

5556
err = os.WriteFile(filepath.Join(fakeRegPath, "hosts.toml"), []byte(hostsToml), 0644)
@@ -68,27 +69,6 @@ server = "https://%v:%v"
6869
}
6970
}
7071
}
71-
72-
{
73-
log.Info("Updating CA certificates in the node...")
74-
shCmd := exec.Command("update-ca-certificates", "-f")
75-
shCmd.Stdin = os.Stdin
76-
shCmd.Stderr = os.Stderr
77-
shCmd.Stdout = os.Stdout
78-
79-
err := shCmd.Run()
80-
if err != nil {
81-
log.Fatalf("cannot update CA certificates: %v", err)
82-
}
83-
84-
sourceCA := "/etc/ssl/certs/ca-certificates.crt"
85-
targetCA := filepath.Join(hostfs, "/etc/ssl/certs/ca-certificates.crt")
86-
87-
err = copyFile(sourceCA, targetCA)
88-
if err != nil {
89-
log.Fatal(err)
90-
}
91-
}
9272
},
9373
}
9474

@@ -101,7 +81,6 @@ func init() {
10181

10282
_ = setupCmd.MarkFlagRequired("hostname")
10383
_ = setupCmd.MarkFlagRequired("hostfs")
104-
_ = setupCmd.MarkFlagRequired("ca-directory")
10584
}
10685

10786
func hostExists(hostname, hostsPath string) bool {

‎components/ws-manager-api/go/config/config.go

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -88,9 +88,6 @@ type Configuration struct {
8888
Timeouts WorkspaceTimeoutConfiguration `json:"timeouts"`
8989
// InitProbe configures the ready-probe of workspaces which signal when the initialization is finished
9090
InitProbe InitProbeConfiguration `json:"initProbe"`
91-
// WorkspaceCACertSecret optionally names a secret which is mounted in `/etc/ssl/certs/gp-custom.crt`
92-
// in all workspace pods.
93-
WorkspaceCACertSecret string `json:"caCertSecret,omitempty"`
9491
// WorkspaceURLTemplate is a Go template which resolves to the external URL of the
9592
// workspace. Available fields are:
9693
// - `ID` which is the workspace ID,

‎components/ws-manager-mk2/controllers/create.go

Lines changed: 0 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -267,16 +267,6 @@ func createDefiniteWorkspacePod(sctx *startWorkspaceContext) (*corev1.Pod, error
267267
prefix = "prebuild"
268268
case workspacev1.WorkspaceTypeImageBuild:
269269
prefix = "imagebuild"
270-
// mount self-signed gitpod CA certificate to ensure
271-
// we can push images to the in-cluster registry
272-
workspaceContainer.VolumeMounts = append(workspaceContainer.VolumeMounts,
273-
corev1.VolumeMount{
274-
Name: "gitpod-ca-certificate",
275-
MountPath: "/usr/local/share/ca-certificates/gitpod-ca.crt",
276-
SubPath: "ca.crt",
277-
ReadOnly: true,
278-
},
279-
)
280270
default:
281271
prefix = "ws"
282272
}
@@ -321,51 +311,6 @@ func createDefiniteWorkspacePod(sctx *startWorkspaceContext) (*corev1.Pod, error
321311
},
322312
},
323313
}
324-
if sctx.Workspace.Spec.Type == workspacev1.WorkspaceTypeImageBuild {
325-
volumes = append(volumes, corev1.Volume{
326-
Name: "gitpod-ca-certificate",
327-
VolumeSource: corev1.VolumeSource{
328-
Secret: &corev1.SecretVolumeSource{
329-
SecretName: "builtin-registry-facade-cert",
330-
Items: []corev1.KeyToPath{
331-
{Key: "ca.crt", Path: "ca.crt"},
332-
},
333-
},
334-
},
335-
})
336-
}
337-
338-
// This is how we support custom CA certs in Gitpod workspaces.
339-
// Keep workspace templates clean.
340-
if sctx.Config.WorkspaceCACertSecret != "" {
341-
const volumeName = "custom-ca-certs"
342-
volumes = append(volumes, corev1.Volume{
343-
Name: volumeName,
344-
VolumeSource: corev1.VolumeSource{
345-
Secret: &corev1.SecretVolumeSource{
346-
SecretName: sctx.Config.WorkspaceCACertSecret,
347-
Items: []corev1.KeyToPath{
348-
{
349-
Key: "ca.crt",
350-
Path: "ca.crt",
351-
},
352-
},
353-
},
354-
},
355-
})
356-
357-
const mountPath = "/etc/ssl/certs/gitpod-ca.crt"
358-
workspaceContainer.VolumeMounts = append(workspaceContainer.VolumeMounts, corev1.VolumeMount{
359-
Name: volumeName,
360-
ReadOnly: true,
361-
MountPath: mountPath,
362-
SubPath: "ca.crt",
363-
})
364-
workspaceContainer.Env = append(workspaceContainer.Env, corev1.EnvVar{
365-
Name: "NODE_EXTRA_CA_CERTS",
366-
Value: mountPath,
367-
})
368-
}
369314

370315
workloadType := "regular"
371316
if sctx.Headless {

‎components/ws-manager/pkg/manager/create.go

Lines changed: 0 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -443,51 +443,6 @@ func (m *Manager) createDefiniteWorkspacePod(startContext *startWorkspaceContext
443443
},
444444
}
445445

446-
// This is how we support custom CA certs in Gitpod workspaces.
447-
// Keep workspace templates clean.
448-
if m.Config.WorkspaceCACertSecret != "" {
449-
const volumeName = "custom-ca-certs"
450-
volumes = append(volumes, corev1.Volume{
451-
Name: volumeName,
452-
VolumeSource: corev1.VolumeSource{
453-
Secret: &corev1.SecretVolumeSource{
454-
SecretName: m.Config.WorkspaceCACertSecret,
455-
Items: []corev1.KeyToPath{
456-
{
457-
Key: "ca.crt",
458-
Path: "ca.crt",
459-
},
460-
},
461-
},
462-
},
463-
})
464-
465-
const mountPath = "/etc/ssl/certs/gitpod-ca.crt"
466-
workspaceContainer.VolumeMounts = append(workspaceContainer.VolumeMounts, corev1.VolumeMount{
467-
Name: volumeName,
468-
ReadOnly: true,
469-
MountPath: mountPath,
470-
SubPath: "ca.crt",
471-
})
472-
workspaceContainer.Env = append(workspaceContainer.Env, corev1.EnvVar{
473-
Name: "NODE_EXTRA_CA_CERTS",
474-
Value: mountPath,
475-
})
476-
}
477-
478-
if req.Type == api.WorkspaceType_IMAGEBUILD {
479-
// mount self-signed gitpod CA certificate to ensure
480-
// we can push images to the in-cluster registry
481-
workspaceContainer.VolumeMounts = append(workspaceContainer.VolumeMounts,
482-
corev1.VolumeMount{
483-
Name: "gitpod-ca-certificate",
484-
MountPath: "/usr/local/share/ca-certificates/gitpod-ca.crt",
485-
SubPath: "ca.crt",
486-
ReadOnly: true,
487-
},
488-
)
489-
}
490-
491446
workloadType := "regular"
492447
if startContext.Headless {
493448
workloadType = "headless"
@@ -649,20 +604,6 @@ func (m *Manager) createDefiniteWorkspacePod(startContext *startWorkspaceContext
649604
}
650605
}
651606

652-
if req.Type == api.WorkspaceType_IMAGEBUILD {
653-
pod.Spec.Volumes = append(pod.Spec.Volumes, corev1.Volume{
654-
Name: "gitpod-ca-certificate",
655-
VolumeSource: corev1.VolumeSource{
656-
Secret: &corev1.SecretVolumeSource{
657-
SecretName: "builtin-registry-facade-cert",
658-
Items: []corev1.KeyToPath{
659-
{Key: "ca.crt", Path: "ca.crt"},
660-
},
661-
},
662-
},
663-
})
664-
}
665-
666607
return &pod, nil
667608
}
668609

‎components/ws-manager/pkg/manager/create_test.go

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,10 @@ func TestCreateDefiniteWorkspacePod(t *testing.T) {
5353
type fixture struct {
5454
WorkspaceClass
5555

56-
Spec *json.RawMessage `json:"spec,omitempty"` // *api.StartWorkspaceSpec
57-
Request *json.RawMessage `json:"request,omitempty"` // *api.StartWorkspaceRequest
58-
Context *startWorkspaceContext `json:"context,omitempty"`
59-
CACertSecret string `json:"caCertSecret,omitempty"`
60-
Classes map[string]WorkspaceClass `json:"classes,omitempty"`
56+
Spec *json.RawMessage `json:"spec,omitempty"` // *api.StartWorkspaceSpec
57+
Request *json.RawMessage `json:"request,omitempty"` // *api.StartWorkspaceRequest
58+
Context *startWorkspaceContext `json:"context,omitempty"`
59+
Classes map[string]WorkspaceClass `json:"classes,omitempty"`
6160

6261
EnforceAffinity bool `json:"enforceAffinity,omitempty"`
6362
DebugWorkspacePod bool `json:"debugWorkspacePod,omitempty"`
@@ -74,7 +73,6 @@ func TestCreateDefiniteWorkspacePod(t *testing.T) {
7473
fixture := input.(*fixture)
7574

7675
mgmtCfg := forTestingOnlyManagerConfig()
77-
mgmtCfg.WorkspaceCACertSecret = fixture.CACertSecret
7876
mgmtCfg.DebugWorkspacePod = fixture.DebugWorkspacePod
7977

8078
if fixture.Classes == nil {
@@ -198,11 +196,10 @@ func TestCreatePVCForWorkspacePod(t *testing.T) {
198196
type fixture struct {
199197
WorkspaceClass
200198

201-
Spec *json.RawMessage `json:"spec,omitempty"` // *api.StartWorkspaceSpec
202-
Request *json.RawMessage `json:"request,omitempty"` // *api.StartWorkspaceRequest
203-
Context *startWorkspaceContext `json:"context,omitempty"`
204-
CACertSecret string `json:"caCertSecret,omitempty"`
205-
Classes map[string]WorkspaceClass `json:"classes,omitempty"`
199+
Spec *json.RawMessage `json:"spec,omitempty"` // *api.StartWorkspaceSpec
200+
Request *json.RawMessage `json:"request,omitempty"` // *api.StartWorkspaceRequest
201+
Context *startWorkspaceContext `json:"context,omitempty"`
202+
Classes map[string]WorkspaceClass `json:"classes,omitempty"`
206203

207204
EnforceAffinity bool `json:"enforceAffinity,omitempty"`
208205
}
@@ -218,7 +215,6 @@ func TestCreatePVCForWorkspacePod(t *testing.T) {
218215
fixture := input.(*fixture)
219216

220217
mgmtCfg := forTestingOnlyManagerConfig()
221-
mgmtCfg.WorkspaceCACertSecret = fixture.CACertSecret
222218

223219
if fixture.Classes == nil {
224220
fixture.Classes = make(map[string]WorkspaceClass)

‎components/ws-manager/pkg/manager/testdata/cdwp_affinity.golden

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -267,4 +267,4 @@
267267
},
268268
"status": {}
269269
}
270-
}
270+
}

0 commit comments

Comments
 (0)